Client Certificate Authentication
(Versions 7.9.0+, Web & KeePass clients)
Client Certificate Authentication is an advanced security mechanism allowing connecting Clients to prove their identity to a Server by providing a Certificate. This can be accomplished by configuring IIS to require an established Certificate from the connecting devices.
- Setup of IIS (7.5+) to host Password Server
Step-by-Step Reference for Configuring IIS for client certificates
Here the manual steps for configuring your IIS site to map certificates.
This steps are technical and quite involved, and need to be followed closely to ensure something is not missed.
Configuring KeePass for Pleasant Client
Here is a technical summary of how the functionality works:
- The Client will establish a TLS/SSL session with IIS, and send a request. IIS sends a new TLS/SSL request to re-negotiate based on the client certificate authentication, and asks for a certificate. Once provided by the client, the second TLS/SSL negotiation completes successfully.
- To set the option, open this KeePass config file:
Look for the Thumbprint on your client certificate. Add a line called ClientCertThumbprint so that the file includes lines that look similar to this:
Using Client Certificate Authentication
When KeePass opens, a user can click Advanced Options
To choose another Certificate a user can select one from their Certificate Store, or enter a Certificate Store