> For the complete documentation index, see [llms.txt](https://community-test.logicnets.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://community-test.logicnets.com/release-9/platform-documentation/system-administration/installation/iis-client-certificate-mapping-configuration.md).

# IIS Client Certificate Mapping Configuration

This document describes the steps required to configure IIS to use client certificate mapping. This allows a client to authenticate itself by presenting a specific required certificate.

## Installation Steps

### Install the Public Certificate in the Trusted Root Certification Authorities Store

1. Run *mmc.exe* -> *File* -> *Add/Remove Snap-in*… -> *Certificate* -> *Add*. Choose *Computer account* -> *Next* -> *Finish* -> OK.
2. Navigate to *Trusted Root Certification Authorities* -> *Certificate folder*.
3. Choose menu option *Action* -> *All Tasks* -> *Import*.
4. Click *Next* -> *select public certificate file* -> *Next* -> *Next* -> *Finish*.
5. Close MMC.

### Configure One-to-One Client Certificate Mappings

Add IIS Client Certificate Mapping Authentication through *Server Manager* -> *IIS* -> *Server Roles* under *Web Server\Web Server\Security*.

You can find information on how to do this at <http://www.iis.net/learn/manage/configuring-security/configuring-one-to-one-client-certificate-mappings>.

### Get the Certificate Blob

The oneToOneMappings collection item has an attribute called *certificate*. The required value for this attribute is the actual certificate blob. Here's how to extract it.

1. Right-click on your .cer file.
2. Select *Open With...* in the context menu.
3. Select Notepad from the list of other programs and click *OK*. \[Note: Notepad may be hidden beneath a dropdown in the Vista/Windows 2008 list view.]
4. Remove *-----BEGIN CERTIFICATE-----* and *-----END CERTIFICATE----*.
5. Format the certificate blob so it is a single line.
6. Save this file as *clientCertBlob.txt*.

This is an example of what should display in Notepad in Step 3

```
-----BEGIN CERTIFICATE-----
MIIEfjCCA2agAwIBAgIKFW1IXAAAAAAAAjANBgkqhkiG9w0BAQUFADAbMRkwFwYD
VQQDExBJSVNSZW1vdGVNZ3JUZXN0MB4XDTA4MDIxMTIxNTk1NloXDTA5MDIxMTIy
MDk1NlowaDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0b24xEDAOBgNV
BAcTB1JlZG1vbmQxDTALBgNVBAoTBE1TRlQxDDAKBgNVBAsTA0lJUzEVMBMGA1UE
AxMMUkxVQ0VSTzItSUlTMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC3611j
34q2qQgHa7ao11TcQMDYlJMrqET05MWFY1/Vso+leujLoIGTfdHOuz4IBVoeUE+y
mlL8r53s2BQeVFROnDtg4Jko1zJsz7AUAnQNBk/GYA1AHYmhY79Z0p1KXW/wSTJB
tdUn732GQOqYf4wY8jOD2zUJDUG4HXm6ib8ajwIDAQABo4IB+TCCAfUwDgYDVR0P
AQH/BAQDAgTwMBMGA1UdJQQMMAoGCCsGAQUFBwMBMHgGCSqGSIb3DQEJDwRrMGkw
DgYIKoZIhvcNAwICAgCAMA4GCCqGSIb3DQMEAgIAgDALBglghkgBZQMEASowCwYJ
YIZIAWUDBAEtMAsGCWCGSAFlAwQBAjALBglghkgBZQMEAQUwBwYFKw4DAgcwCgYI
KoZIhvcNAwcwHQYDVR0OBBYEFHbHA+HwZcIrslklj1W3O23UFrBgMB8GA1UdIwQY
MBaAFMxzlGbmkp2+phhDg7TPfi83d7UVMHMGA1UdHwRsMGowaKBmoGSGL2h0dHA6
Ly9paXNzYjMwNS9DZXJ0RW5yb2xsL0lJU1JlbW90ZU1nclRlc3QuY3JshjFmaWxl
Oi8vXFxpaXNzYjMwNVxDZXJ0RW5yb2xsXElJU1JlbW90ZU1nclRlc3QuY3JsMIGe
BggrBgEFBQcBAQSBkTCBjjBEBggrBgEFBQcwAoY4aHR0cDovL2lpc3NiMzA1L0Nl
cnRFbnJvbGwvaWlzc2IzMDVfSUlTUmVtb3RlTWdyVGVzdC5jcnQwRgYIKwYBBQUH
MAKGOmZpbGU6Ly9cXGlpc3NiMzA1XENlcnRFbnJvbGxcaWlzc2IzMDVfSUlTUmVt
b3RlTWdyVGVzdC5jcnQwDQYJKoZIhvcNAQEFBQADggEBAEsSkcx0re36IL80UphJ
w/srR3LBsy8sfwqxBMzMTdF7k6jYtUVpn3D2Dd4JXXVOaEVud9YNn9pr6xJL4t79
Zh+hJzIPA5pQLbccx4vjWB4cWEYxzcoKYCuUdZrfPFXO1a5kQAj8IZ0/6bhMceyR
Z7dRDoaIuAGQLFAlC/KjIBCemDi54MlWtvATQ8bmiRuEOWeneK2Vd2e0fxyezk05
dRqa8DEC74CQN4rQuz395ECm+M/hQnN+dHOygV8n9swd0bdNq8qypwfVUes5HIpj
LFmKTuGyFSVj7jv+64oTxvxtYX2QFp9q6Bi+qj0uyrX8Xjxy5rPSVPEfnxPCBg58
RCI=
-----END CERTIFICATE-----
```

### Enabling IIS Client Certificates Mapping Authentication and One-to-One Certificate Mapping for a Website

The next steps describe how to enable the Client Certificate Mapping Authentication feature, One-to-One Certificate Mapping, and add a mapping entry.

1. Start **Inetmgr**, the IIS Manager UI.
2. Select the SSL website that is being configured, and open **Configuration Editor**.
3. Type the following in the **Section** dropdown box:

   ```
   system.webServer/security/authentication/iisClientCertificateMappingAuthentication
   ```
4. Select the **enabled** field and change the value to *true*.
5. Select the **oneToOneCertificateMappingsEnabled** property grid entry and change the value to *true*.
6. Select the **oneToOneMappings** property grid entry and click **Edit Items...** in the Actions task pane.
7. Click **Add** in the **Collection Editor** task list.
8. Copy the single-string certificate blob from above and paste it into the **certificate** field.
9. Set the **userName** and **password** that clients will be authenticated as.
10. Set the **enabled** field to *true*.
11. Close the Collection Editor.
12. Click **Apply** in the Actions task pane. \[*Note:* Click **Script Generation** prior to clicking **Apply** to get scripts for this process.]

Once you have completed these steps, the server is configured to handle IIS Client Certificate Mapping authentication with a single, one-to-one certificate mapping entry.

### Enabling Client Certificate Authentication for a Website Using SSL

Once you have created a mapping and enabled the feature, you must configure your site to use client certificates. Perform the following steps to do this.

1. From within **Inetmgr**, the IIS Manager UI, select the SSL website for which you want to use client certificates.
2. Select the **SSL** UI module.
3. Under **Client certificates** select the **Accept** radio button.
4. Click **Apply** in the Actions task pane.

You have now configured the website to accept and authenticate clients based on client certificates.

## Using Client Certificates in Standard LogicNets Applications

### DesignerStarter

By default, the DesignerStarter supports setting up a connection to a Document Management System (DMS) using a secure HTTPS connection. It uses client certificates for authorization when they have been configured. The following steps explain how to set this up.

1. Make sure the DMS has client certificate mapping set up.
2. Copy the DMS server certificate, which is used to validate the certificate received from the server, to */dat/certificates/server.crt.* This should be in the base64-encoded format.
3. Copy your client certificate, which is used to authenticate LogicNets to */dat/certificates/client.crt*.
4. Copy your non-password-protected client private key, which is used to encrypt the certificate, to */dat/certificates/client\_private\_key.pem*.
5. Open the LogicNets configuration file (*/system/lib/sys/settings.cfg*) or create/adapt the company-specific configuration file (*/dat/bnt//settings.cfg*) and check/update the paths in the *\_context / DesignerStarter* section.

![](https://2802811211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdFhfexCjZ5JMhwGzzywq%2Fuploads%2Fgit-blob-ecd49daa7a72d7cb529d64c087477aefcbdb46bc%2Fafc5310a-d17b-4516-b5fe-6b9c3f45abd8.jpg?alt=media)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://community-test.logicnets.com/release-9/platform-documentation/system-administration/installation/iis-client-certificate-mapping-configuration.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.