Certificate Authentication is not working after IIS publish

Wondering this issue got resolved

Also check these 2 links: 
https://arunkrsoam.medium.com/rest-api-https-client-certificate-authentication-net-core-c-dd87f8a9647f

https://github.com/Hoeckelberg/ProofofConceptHandyApp

Check your web.config is correctly configured to pass through the client certificates:

Hello Prashad,
I already did all the steps you mentioned. But it's not working. After enabling the SSL check from IIS my site just got stopped loading. I have added the certificate as well in the bindings. I got Error: read ECONNRESET this error in postman.

Here’s a detailed step-by-step guide to ensure proper configuration:

1. Import the Certificate:

   • Open the Certificate Manager (certlm.msc for local machine).
   • Import the .pfx file into the "Personal" store.

2. Set Permissions:

   • In the Certificate Manager, find your certificate in the "Personal" store.
   • Right-click the certificate, go to "All Tasks" -> "Manage Private Keys".
   • Add the application pool identity and give it read access.

3. Configure IIS:

   • Open IIS Manager.
   • Select your site, go to "SSL Settings", and ensure that "Require SSL" is checked.
   • Ensure that "Require" or "Accept" under "Client certificates" is selected.
   • Go to "Bindings" for your site and ensure that your SSL binding has the correct certificate selected.
4. Update Application Configuration:

Make sure your application is properly configured to handle client certificates in Startup.cs:

public void ConfigureServices(IServiceCollection services)
{
    services.AddAuthentication(CertificateAuthenticationDefaults.AuthenticationScheme)
        .AddCertificate(options =>
        {
            options.AllowedCertificateTypes = CertificateTypes.All;
            options.RevocationMode = X509RevocationMode.NoCheck;
        });
    
    services.AddAuthorization();
    services.AddControllers();
}

public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
{
    if (env.IsDevelopment())
    {
        app.UseDeveloperExceptionPage();
    }

    app.UseHttpsRedirection();
    app.UseRouting();
    app.UseAuthentication();
    app.UseAuthorization();
    app.UseEndpoints(endpoints =>
    {
        endpoints.MapControllers();
    });
}

If you've checked and configured all the above and it still doesn't work, consider sharing specific error messages or logs for more detailed assistance.

Hi Vijay Pratap Singh,

Here are a few common issues to check:

1. Certificate Installation: Ensure that the client certificate (.pfx) is correctly installed on the server where IIS is hosted. You can install the certificate using the Microsoft Management Console (MMC) or PowerShell.

2. Binding Configuration: Check the SSL binding configuration in IIS. Make sure that the correct certificate is selected for the HTTPS binding of your website or application.

3. Client Certificate Mapping: In IIS, ensure that client certificate mapping is enabled and properly configured. You can configure this through IIS Manager by selecting your website or application, then going to "SSL Settings" and then "Client Certificates". Make sure it's set to "Require".

4. Certificate Trust: Ensure that the client's certificate is trusted by the server. If the client certificate is self-signed or issued by an unknown Certificate Authority (CA), you may need to manually add it to the Trusted Root Certification Authorities store on the server.

5. Permissions: Check the permissions of the certificate file (.pfx) and the folder containing it. The application pool identity under which your application runs may need read access to the certificate file.

6. Code Configuration: Verify that your code is correctly configured to use client certificate authentication. Ensure that the certificate thumbprint or subject is correctly specified in your code.

7. Logging and Debugging: Implement logging in your application to capture any errors or exceptions related to certificate authentication. This can help diagnose the issue further.

8. Firewall: Ensure that there are no firewall rules blocking incoming connections on the HTTPS port (usually port 443).