Here’s how I did this, on IIS 7.5:
- Run the following in an admin command prompt:
netsh http show sslcert
-
Save the output in a text file. Will look something like this:
IP:port : 0.0.0.0:443 Certificate Hash : [a hash value] Application ID : {[a GUID]} Certificate Store Name : MY Verify Client Certificate Revocation : Enabled Verify Revocation Using Cached Client Certificate Only : Disabled Usage Check : Enabled Revocation Freshness Time : 0 URL Retrieval Timeout : 0 Ctl Identifier : (null) Ctl Store Name : (null) DS Mapper Usage : Disabled Negotiate Client Certificate : Disabled
-
Create a batch file using that info:
netsh http show sslcert netsh http delete sslcert ipport=0.0.0.0:443 netsh http add sslcert ipport=0.0.0.0:443 certhash=[your cert hash from above] appid={[your GUID from above]} certstorename=MY verifyclientcertrevocation=enable VerifyRevocationWithCachedClientCertOnly=disable UsageCheck=Enable clientcertnegotiation=enable netsh http show sslcert
(Yes, you have to delete and re-add; you can’t just alter clientcertnegotiation in-place. That’s why it’s important to save the hash and GUID, so it knows what to re-add.)
-
Run that batch file, check for any errors, done.
Keep in mind that this setting is applied per-certificate, not per-server. So if you use multiple certs, or change/update your cert, you will have to do this again.