Troubleshooting: Client-Side SSL Realm Prompts to Select a Certificate Several Times

Version Affected: All
 
 

Overview

Authenticating to a Client-Side SSL (cSSL) realm may prompt the user to select their client certificate three to six times before authentication fully succeeds, when using Firefox or Safari.

Cause

Requiring client certificates at the full realm level, rather than only on the specific page that needs it, can cause repeated prompting in Firefox or Safari due to those browsers' security preferences.

Resolution:

Configure the realm to ignore client certificates at the realm level, but require them specifically on cSSL.aspx, the one page that actually needs the certificate:

1. Open IIS Manager, expand the server, then Sites > Default Web Site, and select the realm with the cSSL issue.

2. With the realm selected, double-click SSL Settings in the middle pane's IIS section.

3. Under Client certificates, select Ignore, then click Apply in the Actions pane on the right.

4. With the realm still selected, click Content View in the lower bar of the middle section.

5. Find the file cSSL.aspx, right-click it, and select Switch to Features View.

6. With the middle section now showing cSSL.aspx specifically, double-click SSL Settings again.

7. Set Client certificates to Require, then click Apply in the Actions pane.

8. Test authentication to the realm to confirm the change worked -- end users should now only need to select their client certificate once.

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.