title: .Net Core Web API with Client Certificate Authentication
body: <p>I've developed a simple WEB API service in .Net Core 2.1</p>
  
  <p>I'm trying to implement a client certificate authentication, so I can give access to the APIs only to the clients that have a specific certificate installed on their machine.</p>
  
  <p>The clients access the API using a browser (Chrome, Edge, IE11 or Firefox).</p>
  
  <p>I've added in the API method the request for the certificate:</p>
  
  <pre><code>[HttpGet]
  public ActionResult&lt;IEnumerable&lt;string&gt;&gt; Get()
  {
  
      X509Certificate2 cert = Request.HttpContext.Connection.ClientCertificate;
      if (cert!=null &amp;&amp; cert.Verify())
      {
          //more verification here...
          return Content("....", "application/json");
      }
      else
      {
          return Content("....", "application/json");
      }
  
  }
  </code></pre>
  
  <p>then I've installed a self-signed certificate and added to the Trusted Root, enabling the Client Authentication purpose.</p>
  
  <p><a href="https://i.stack.imgur.com/bmyWT.png" rel="noreferrer"><img src="https://i.stack.imgur.com/bmyWT.png" alt="enter image description here"></a></p>
  
  <p>but the variable <em>cert</em> is always null and the browser didn't even prompt me to use a certificate when I request the page.</p>
  
  <p>I suppose because I have to set somewhere that the web server must ask for the client certificate as it is possible to set in IIS, but in my development environment, I'm using IIS Express.</p>
  
  <p>How can I force IIS express to request a client certificate?</p>