Microsoft Sharepoint Products and Technologies Resource Kit eBook

740 Part VIII: Securing SharePoint Products and Technologies
6. If one or more Inheritance Overrides dialog boxes appear, click Select All,
and then click OK for each dialog box.
Note You can map client certificates to Windows security accounts and
then use client certificates for authentication. This process is called an
account mapping. You enable account mapping by selecting Enable client
certificate mapping check box from the Secure Communications dialog.
For more information and detailed instructions, refer to the white paper
“Enabling Client Certificates and Using Client Certificates When Crawling
Content with SharePoint Portal Server 2003,” located at http:
//www.microsoft.com/technet/prodtechnol/office/sps2003/maintain
/clicerts.asp?frame=true.
To create a certificate trust list (optional)
This step is optional. After you have required client certificates, you can further
tighten the access security by specifying the list of certificate authorities (CAs) that
your portal site trusts. A client with a certificate issued by a CA that is a member of
this list will be allowed access, whereas clients with certificates issued by other CAs
will be denied access to your portal site.
Before you can add the certificate authorities to a certificate trust list, the certificate
authorities must be installed on the server. The steps for installing the certificate
authorities on the server are found in “Obtaining and Installing the Certificate
Authority Root” in the “Troubleshooting” section at the end of this chapter.
Both the CA that issued the client certificate and the CA that issued the server
certificate must be considered trusted certification authorities. If the server certificates
and client certificates are issued by the same certification authority and you
successfully performed certification validation in the procedure “To verify that the
certificate is valid” earlier in this chapter, the CA is installed on the server.
To check if the CA is installed on the server, you may do the following:
1. Obtain the client certificate without a private key (.cer file). The client certificate
without the private key can be exported from the computer where the certificate
is installed.
2. Right-click the .cer file, point to Open With, and then click Crypto Shell
Extensions.