Adding a CA Certificate to a Certificate Trust List (CTL) in IIS 5.1 on Windows XP Professional

IIS Certificate Trust Lists (CTLs) are used to restrict the set of acceptable client certificates on a per-web-site basis. When a CTL is configured clients are authenticated if they provide a certificate issued by one of the CAs identified by the CTL. Authorization is controlled through certificate mapping.

1. Open the Microsoft Management Console for IIS if it is not already open.
2. Select the Web site where you wish to install a Server Certificate and right click to open its ‘Properties’. In this example we have selected the ‘Default Web Site’.

3. When the Web site ‘Properties’ tab pane opens select the ‘Directory Security’ tab and then click ‘Edit…’.

4. When the ‘Secure Communications’ dialog box opens select ‘Enable certificate trust list’ and click on ‘New…’.

5. When the ‘Certificate Trust List Wizard’ opens select ‘Next >’.

6. Since this is a new CTL it will not contain any CA certificates (note that an existing CTL could have been edited in step 4 above and the following procedures work for editing as well). Thus, the ‘Certificates in the CTL’ pane will be empty. Select ‘Add from Store’.

7. The ‘Select Certificate’ dialog box will open. Select one or many root certificates and click ‘OK’.

8. The ‘Certificates in the CTL’ pane will now be populated with the certificate(s) you selected. Click ‘Next >’.

9. When the ‘Name and Description’ pane opens enter a name and description. Click ‘Next >’ when done.

10. The ‘Completing the Certificate Trust List Wizard’ will open. Review the summary information and select ‘Finish’ when done.

11. Select ‘OK’ when the ‘Certificate Trust List Wizard’ status dialog appears.

12. Select ‘OK’ in the ‘Secure Communications’ dialog box.

13. Select ‘Apply’ in the ‘Web Site ‘Properties’ dialog box. The new CTL is now enabled.

Top

Back to Web Page Access Control Using PKI
PKI Lab Home

---

Dartmouth College PKI Lab
Last update: 26 February 2003