title: Creating .NET web service with client certificate authentication
body: <p>I want to limit the access to my .NET web service to a specific list of clients. They will attach their client certificate to their every request and only get a proper response if they are "on the list".</p>
  
  <p>But how and where is the best way to implement this?</p>
  
  <p>On the IIS (7.0) I can set the require client certificate option, but where do I specify which client certificates I will allow access? Do I need the public part of the client certificates in the certificate store of the web server machine?</p>
  
  <p>Or must a setup like this be handled in code, where I somehow extract the client certificate ID and match it to a local list?</p>
  
  <p>Or another way?</p>