总的来说,选择require,客户端必须提供client certificate, 证书可以从CA中心签发,在IE的tools - option - connect菜单里有列出很多证书中心,可以向他们申请. 这些证书中心应该IIS都默认支持的,若有不支持的,也许应该安装他们的根证书,这样就可以识别了.
因为我是写浏览器端插件的,所以对IIS不是很熟.但从客户端的角度来看,客户端可以不提供证书(如B2C)模式, 也可以以对等方式提供证书(如B2B)模式.
至于如何判断是否真的建立了加密通道,我想也许可以用一个笨办法, 用IE访问你那个网站,URL为https://.......,取得页面后看浏览器底部状态栏里是否有一个小锁,鼠标指上去应该会显示: SSL 128... :-)

本文发表在 rolia.net 枫下论坛> 如果选择require，客户端不能访问加密端口，要求提供client
> certificate，从哪里得到？如何与server匹配？

If you want to use the certificate on the Internet, you'll need to get one from one of the CA (verisign, thawte, equifax, etc.). If for internal use, you can setup your own CA and sign cert for both server and client.

In order for the server to be able to authenticate the client, the server must have the CA certificate that signs the client certificate installed as trusted CA. Usually the browser comes with surficiant(spelling?) CA certificate.

> 请问，ignore和accept有何分别？是真的建立加密通道了吗？如何验
> 证？require的情况下，如何得到client certificate？

My understanding is, ignore will not require any client certificate; accept will ask for client certificate but it's not mandatory. Often, you can assign different privilages for users with and without certificate on the server side.

To make sure the secure channel has been established, see the corner of your IE brower, there shoud be a lock that is locked. If you are still worried, get a sniffer (NT/2k's network monitor will do) and sniff the wire and see if you can get some plain text.

See above for client certificate.更多精彩文章及讨论，请光临枫下论坛 rolia.net

作为商业网站，要求客户do something是愚蠢又失礼的，万不得已时才能要求客户升级他们的软件，或安装什么东西。

因此，我希望建立安静连接，或者是有一次security alert。不希望客户安装证书，或者被莫名其妙的popup window迷惑。

因为我很想知道大型商业网站是如何制作他们的加密方案的。

多谢。