I know that I can use http.sys as the web server for asp.net core web api as documented here (https://docs.microsoft.com/en-us/aspnet/core/fundamentals/servers/httpsys, see section "When to use HTTP.sys"). I also know that I can write a simple middleware component to request/validate client certificate with a simple HttpContext.Connection.GetClientCertificateAsync call. Is this the only way to force the client certificate in this stack?
When client makes first request to the server, TLS 1.2 protocol kicks in before the request is served by the server. The TLS 1.2 specification has a way to perform the client certificate procedure while establishing the secure communication between client and server, provided that server requests client certificate. The keyword is only if the server requires it. I looked at netsh command that shows https endpoints. The clientcertnegotiation property only negotiates but does not force it, which means client can choose not to submit a certificate. How do I tell http.sys to force the client certificate without writing any middleware component?