title: Is it possible to use client certificates in Windows Azure Websites
body: <p>I am developing a windows service application that will run on customer PC/servers and access a Web API endpoint hosted in an Azure Website. It needs to authenticate the user, and I would prefer not storing credentials on the customer's machine.  So, I've landed on client certificates to authenticate the users.  I have this working against a local, non-Azure Website IIS instance with self-signed certificates.  However, I'm unable to get it working in an Azure Website.  </p>
  
  <p>As far as I can tell, there are two issues that I'm not finding much documentation on:</p>
  
  <ul>
  <li>How do I install my own CA certificate in the Trusted Root of the Website instance(s)?  Or will this only work with CA certificates that are already trusted?</li>
  <li>How do I enable "Accept Client Certificates" for this application?  In IIS you do this under "SSL Settings".  Documentation indicates that modifying the system.webServer/security/access node of app.config will accomplish this, but obviously you can't do that in Websites.  Documentation for websites suggests this node is unlocked for use in web.config, however adding that node results in an error "The page cannot be displayed because an internal server error has occurred.", even if custom errors is off.  </li>
  </ul>