I want to limit the access to my .NET web service to a specific list of clients. They will attach their client certificate to their every request and only get a proper response if they are "on the list".

But how and where is the best way to implement this?

On the IIS (7.0) I can set the require client certificate option, but where do I specify which client certificates I will allow access? Do I need the public part of the client certificates in the certificate store of the web server machine?

Or must a setup like this be handled in code, where I somehow extract the client certificate ID and match it to a local list?

Or another way?