ClientCertificate

The ClientCertificate collection retrieves the certification fields (specified in the X.509 standard) from the request issued by the Web browser.

If a Web browser uses the SSL3.0/PCT1 protocol (in other words, it uses a URL starting with “https://” instead of “http://”) to connect to a server and the server requests certification, the browser sends the certification fields.

If no certificate is sent, the ClientCertificate collection returns EMPTY.

Before you can use the ClientCertificate collection, you must configure your Web server to request client certificates. For more information see Using Client Certificates in the Active Server Pages Scripting Guide.

Syntax

Request.ClientCertificate( Key[SubField] )

Parameters

Key

Specifies the name of the certification field to retrieve. A client certificate consists of the following fields.

SubField

An optional parameter you can use to a retrieve an individual field in either the “Subject” or “Issuer” keys. This parameter is added to the Key parameter as a suffix. For example: “IssuerO” or “SubjectCN”. The following table lists some common SubField values.

SubField values other than those listed in the preceding table can be identified by their ASN.1 identifier. The format of the ASN.1 identifier is a list of numbers separated by a period (.). For example: “3.56.7886.34”.

Remarks

You can use an iterator to loop through the keys of the ClientCertificate collection. This is demonstrated in the following example.

<%
For Each key in Request.ClientCertificate
   Response.Write( key & ": " & Request.ClientCertificate(key) & "<BR>")
Next
%>
 

Examples

The following example uses the Subject key to test whether a client certificate has been presented.

<%
If Len(Request.ClientCertificate("Subject")) = 0
    Response.Write("No client certificate was presented")
End if
%>
 

The following example retrieves the common name of the company that issued the client certificate.

<%= Request.ClientCertificate("IssuerCN") %>
 

The following example checks the organization name of the subject of the client certification.

<% 
If (Request.ClientCertificate("SubjectO")="Msft")
   Response.Write("Good Choice!")
End if
%>
 

The following example displays the expiration date of the client certificate.

This certification will expire on 
<%= Request.ClientCertificate("ValidUntil") %>
 

The following example uses the Flags key to test whether the issuer of the certificate is known. The include statement in the first line enables this script to use the named flag ceUnrecognizedIssuer.

<!--#include file="cervbs.inc" -->
<%
   if Request.ClientCertificate("Flags") and ceUnrecognizedIssuer then
      Response.Write "Unrecognized issuer"
   end if 
%>
 

Applies To

Request Object

See Also

Cookies, Form, QueryString, ServerVariables

© Microsoft Corporation. All rights reserved.