I'm trying to secure a web application by means of requiring a client certificate. This is certainly not my area of expertise, but I think I've got it figured out and would just like some confirmation.
1 - I've created (using makecert.exe), a self-signed certificate valid for server and client authentication.
2 - I've selected this certificate as that for my web site and chosen to "Require Client Certificates".
3 - I've made doubly sure that this same certificate is in the machines "Trusted Root Certification Authorities".
Now my understanding and testing has shown that a user can now only access the site if they have this same certificate (exported including its private key) installed on their system. My understanding though is that the client authentication check is looking for a match in the machines "Trusted Root Certification Authorities". Am I right in thinking that this cert ...
Go to the complete details ...