Troubleshooting: Client-Side SSL Realm Prompts to Select a Certificate Several Times – SecureAuth Support

Version Affected: All

Overview

Authenticating to a Client-Side SSL (cSSL) realm may prompt the user to select their client certificate three to six times before authentication fully succeeds, when using Firefox or Safari.

Cause

Requiring client certificates at the full realm level, rather than only on the specific page that needs it, can cause repeated prompting in Firefox or Safari due to those browsers' security preferences.

Resolution:

Configure the realm to ignore client certificates at the realm level, but require them specifically on cSSL.aspx, the one page that actually needs the certificate:

Open IIS Manager, expand the server, then Sites > Default Web Site, and select the realm with the cSSL issue.

IIS Manager tree expanded to Default Web Site, showing a list of SecureAuth realm folders.

With the realm selected, double-click SSL Settings in the middle pane's IIS section.

IIS section of the middle pane with a realm selected, showing the SSL Settings icon highlighted.

Under Client certificates, select Ignore, then click Apply in the Actions pane on the right.

SSL Settings page with Require SSL checked and Client certificates set to Ignore.

With the realm still selected, click Content View in the lower bar of the middle section.

Middle pane showing the Features View and Content View tabs at the bottom.

Find the file cSSL.aspx, right-click it, and select Switch to Features View.

Content View file listing with cSSL.aspx selected.

With the middle section now showing cSSL.aspx specifically, double-click SSL Settings again.

Features View for the cSSL.aspx file specifically, showing its ASP.NET settings icons.

Set Client certificates to Require, then click Apply in the Actions pane.

SSL Settings page for cSSL.aspx with Require SSL checked and Client certificates set to Require.

Test authentication to the realm to confirm the change worked -- end users should now only need to select their client certificate once.

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.