Enabling Negotiate Client Certificate for IIS SSL Bindings via netsh

3/30/2026 8:05 PM

3/30/2026 8:05 PM

Prerequisites

• Administrative access on the Windows server hosting IIS

• Existing SSL certificate already bound (or ready) for the site

• Values you will need:

  • ipport (e.g., 0.0.0.0:443 or a specific IP:port)

  • certhash (thumbprint of the SSL certificate)

  • appid (GUID associated with the application using the binding)

  • certstorename (typically MY for the personal store)

Network Performance Monitor

• You require or accept client certificates and want the client certificate to be sent in the initial TLS handshake, not via a later TLS renegotiation.
• Your clients (browsers, Java apps, proxies, etc.) do not support TLS renegotiation or intentionally reject it due to the known MITM risks around TLS renegotiation. In these cases, leaving negotiation disabled can cause 500 errors or failed client-cert auth until you enable it.

 

 

The pop box asking to select certificate switching not from SolarWinds feature
It’s Chrome asking for a client TLS certificate every time the browser establishes a new HTTPS session with your Orion site.
Configure the front-end (IIS / reverse proxy / load balancer) to reuse TLS sessions or not renegotiate client certs on every request, or
Set a browser / GPO policy to auto-select the appropriate CAC certificate for this URL instead of prompting each time.

1. Open an Elevated Command Prompt

1. Click Start.

2. Search for Command Prompt.

3. Right‑click Command Prompt and select Run as administrator.

All subsequent commands must be run in this elevated window.

---

2. List Existing SSL Certificate Bindings

Run:

netsh http show sslcert

This displays all existing SSL certificate bindings and their current settings, including:

• IP:port the binding is on

• Certificate hash (certhash)

• Application ID (appid)

• Various SSL and client certificate options

Identify the binding that corresponds to your IIS site (by matching the IP:port, certhash, and appid).

---

3. Remove the Existing SSL Binding

Once you’ve identified the correct binding, remove it using the ipport value from the previous command:

netsh http delete sslcert ipport=XXXXX:443

Replace XXXXX:443 with the exact IP:port from netsh http show sslcert.
If the binding listens on all IPs, it may be 0.0.0.0:443.

---

4. Re‑add the SSL Binding with Client Certificate Negotiation Enabled

Recreate the binding and explicitly enable:

• clientcertnegotiation = enable

• dsmapperusage = enable

Example:

netsh http add sslcert ipport=0.0.0.0:443 ^
    certhash=1X1X1X1X1X1X1X1X1X1X1XX1X1X1X1X1X1X1X ^
    appid={2Y2Y2Y2Y2-2Y2Y2Y2-2Y2Y2-2Y2Y2-2Y2Y2Y2Y2Y2Y2Y2Y} ^
    certstorename=MY ^
    verifyclientcertrevocation=enable ^
    VerifyRevocationWithCachedClientCertOnly=disable ^
    UsageCheck=enable ^
    clientcertnegotiation=enable ^
    dsmapperusage=enable

Replace:

• ipport=0.0.0.0:443 with your actual IP:port if different

• certhash=... with the certificate thumbprint from netsh http show sslcert or the certificate properties

• appid={...} with the GUID from the original binding

Key parameters:

• clientcertnegotiation=enable

  • This is what actually sets Negotiate Client Certificate to Enabled.

• dsmapperusage=enable

  • Required if you have mapped client certificates (e.g., using the certificate-to-account mapping).

  • By default this is disabled, and leaving it disabled can break users who rely on mapped certificates.

Other parameters (verifyclientcertrevocation, VerifyRevocationWithCachedClientCertOnly, UsageCheck) are typically left at their default values as shown above unless you have a specific security/policy requirement.

---

5. Confirm the New Binding

Run:

netsh http show sslcert

Verify that:

• The binding exists with the correct ipport, certhash, and appid.

• Client cert negotiation (or equivalent) shows as Enabled.

• DS Mapper Usage shows as Enabled if you set dsmapperusage=enable.

You can then test client certificate authentication on the site. Users with mapped certificates should now authenticate successfully, and the Negotiate Client Certificate behavior will reflect the new settings even though it is not configurable in the IIS GUI.