Is it possible to strengthen forms authentication in ASP.NET with certificates?

Question

My ASP.NET Internet application uses Forms authentication. There is a limited number of users that will sign up to use application. I don't want to use Windows authentication because it will require me to create Windows accounts for all of them (a few thousand). Is it possible that users must provide a certificate in addition to a username and password? If so, how can I do that?

Answer 1

With IIS, it is possible to map a client certificate to a service account that many users can share.

See here for how to generate and install the client certificate

See here for how to setup the mapping

Once this is complete you will need to install the client certificate on each end users' machine. This may prove more difficult than creating an account for each user.