I was looking at the authentication methods that the TMG supports for forward proxy scenario.

http://technet.microsoft.com/en-us/library/cc441695.aspx

My scenario requires proxy to support client certificate auth and the clients connecting to proxy should present a client certificate for connecting to proxy.

Can someone please help if this is possible with TMG? Or can someone please recommend a 3rd party forward proxy software that supports client certificate authentication.

How can i configure TMG to act as a forward proxy requiring client certificate auth

• Merged by Quan GuMicrosoft contingent staff, Moderator 15 hours 35 minutes ago same

How can i configure TMG to act as a forward proxy requiring client certificate auth

• Merged by Quan GuMicrosoft contingent staff, Moderator Saturday, January 18, 2014 8:13 PM same

How can i configure TMG to act as a forward proxy requiring client certificate auth

• Merged by Quan GuMicrosoft contingent staff, Moderator Saturday, January 18, 2014 8:13 PM same

Hi,

Thank you for your post here.

It may be helpful for you.

http://www.isaserver.org/articles-tutorials/configuration-security/Authenticating-Outbound-Web-Traffic-TMG-Firewall-Protected-Networks.html

Best Regards

Quan Gu

Thanks Quan!

Based on the TMG article below,

http://technet.microsoft.com/en-us/library/cc441695.aspx

 looks like Client Certificate auth is not possible in WebAccess (Forward Proxy) case. It is only possible in Web Publishing (Reverse Proxy Scenario)

Hi,

Yes, you are right. We usually use it in publishing scenario. If you would like to use it in forward proxy scenario, it is not allowed.

Why you require this? some special requirements?

Best Regards

Quan Gu

Yes we want the clients to authenticate with the proxy using a client certificate auth. We want to perform custom certificate validations on the proxy server including CRL checks, chain validation, etc.

Hi,

Unfortunately it seems that TMG cannot not have ability to help do that.

Best Regards

Quan Gu