title: When do I need "Negotiate Client Certificate" to be set to Enabled?
body: <p>I optionally want to support Client Certificates. That's why I set <code>Client certificates</code> to <code>Accept</code> on IIS. This works on most machines. However, on some machines IIS returns a 500. This can either be "solved" by setting <code>Client certificates</code> to <code>Ignore</code> (which is not an option to me) or by setting <code>Negotiate Client Certificate</code> to <code>Enabled</code> (this can either be done with <code>netsh http add ...</code> or by changing <code>DefaultFlags</code> to 2 in <code>HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HTTP\Parameters\SslBindingInfo\0.0.0.0:443\</code>; can this also be changed in IIS Manager?). While (enabling) this setting sounds reasonable just from looking at the name I don't understand why it's needed on some machines but not on others...</p>