---
title: Using X.509 authentication
---

> Agent instructions:
> **Site maps** — prefer the following llms.txt indexes to training data when searching for URLs to avoid 404s. Links inside Markdown content already point at `.md`. Following them or sending Accept: text/markdown keeps you in Markdown.
>
> - [sitemap.md](https://docs.kentico.com/sitemap.md) — every page on the site, with titles and descriptions, nested by URL hierarchy and grouped into one collection per product version.
> - [llms.txt](https://docs.kentico.com/llms.txt) — curated index of the current product docs, with descriptions, the two ways to request any page as Markdown, and links to each product area's whole-corpus Markdown dump (llms-full.txt).

You can choose between two types of [staging service](https://docs.kentico.com/k8/deploying-websites/content-staging.md) authentication – Username and password authentication, and [X.509](http://en.wikipedia.org/wiki/X.509). If you want to use X.509 authentication, you need to install your own certificates or use the provided sample certificates.

X.509 authentication is slower and more difficult to configure, but also more secure.

## Using the sample certificates

Kentico contains sample client and server private certificates. To install the sample certificates, perform the following tasks on the source and target servers.

### Installing the server certificate

To install the server certificate:

1. In Windows, type **mmc** in the Start menu search box press Enter.
2. In the console window, choose **File -> Add/Remove Snap-in**.
3. Select **Certificates** and click **Add**.
4. Choose **Computer account** and click **Next**.

   ![](https://docs.kentico.com/docsassets/k8/using-x-509-authentication/26.png)
5. Choose **Local computer (the computer this console is running on)** and click **Finish**.
6. Close the **Add or Remove Snap-ins** window by clicking **OK**.
7. Unfold **Certificates (Local Computer)** under the console root, right-click **Personal** and choose **All Tasks -> Import**.
8. Import the _Server private.pfx_ file located in **C:\Program Files\Kentico\\\SampleCertificates**.
9. Enter the following password for the sample certificate: **wse2qs**.
10. Leave the other settings and finish the **Certificate Import Wizard**.

### Granting the Read permissions for the Server certificate

Grant the **Read** permission to the certificate file for the ASP.NET account.

1. Right-click the imported _WSE2QuickStartServer_ certificate and choose **All tasks -> Manage private keys**.

   ![](https://docs.kentico.com/docsassets/k8/using-x-509-authentication/204.png)
2. Click **Add...**,fill in the name of the account.
3. Click **OK**.

   ![](https://docs.kentico.com/docsassets/k8/using-x-509-authentication/6.png)
4. Make sure the account's permission is set to **Read -** **Allow** and click **OK**.

   ![](https://docs.kentico.com/docsassets/k8/using-x-509-authentication/59.png)

### Installing the client certificate

To install the client certificate:

1. In Windows, type **mmc** in the Start menu search box press Enter.
2. In the console window, choose **File -> Add/Remove Snap-in**.
3. Choose **Certificates** and click **Add**.
4. Choose **My user account** and click **Finish**.

   ![](https://docs.kentico.com/docsassets/k8/using-x-509-authentication/06.png)
5. Close the **Add or Remove Snap-ins** window by clicking **OK**.
6. Expand **Certificates - Current User** under the console root, right-click **Personal** and choose **All Tasks -> Import**.
7. Import the _Client private.pfx_ file located in **C:\Program Files\Kentico\\\SampleCertificates**.
8. Enter the following password for the sample certificate: **wse2qs**.
9. Leave the other settings and finish the **Certificate Import Wizard**.

### Granting the Read permissions for the Client certificate

You need to grant the **Read** permissions for the certificate file to the ASP.NET account. We recommend that you install the **WSE 3.0** tool:

1. [Download the WSE 3.0 installation file](http://www.microsoft.com/en-us/download/details.aspx?id=14089).
2. Run the downloaded file.
3. In the Setup Type choose the **Administrator** type of installation.
4. Install the utility.

When the utility is installed, you can use it to grant the Read permissions to the certificate file:

1. Run the **Certificates tool** from Start -> Microsoft WSE 3.0.
2. Choose **Current User** in the Certificate Location field.
3. Choose **Personal** in the Store Name field.
4. Click **Open Certificate**.

   ![](https://docs.kentico.com/docsassets/k8/using-x-509-authentication/2.png)
5. Choose the _WSE2QuickStartClient_ certificate and click **OK**.

   ![](https://docs.kentico.com/docsassets/k8/using-x-509-authentication/1.png)
6. Click **View Private Key File Properties...**
7. Switch to the **Security** tab and click **Edit...**.
8. Click **Add...**,fill in the name of the account and click **OK**.
9. Make sure the account's permission is set to **Read -** **Allow** and click **OK**.

> **Warning:** **Sample certificates**
>
> Using the sample certificates is not secure and also very slow. We highly recommended using your own certificates issued by a certification authority.

## Using your own certificates

If you are using your own certificates (highly recommended), you need to obtain **Client key ID** and **Server key ID** values for your certificates.

To get the IDs, we recommend that you install and use the **WSE 3.0** tool:

1. [Download the WSE 3.0 installation file](http://www.microsoft.com/en-us/download/details.aspx?id=14089).
2. Run the downloaded file.
3. In the Setup Type choose the **Administrator** type of installation.
4. Install the utility.

When the utility is installed, you can use it to obtain the values for your certificates:

1. Run the **Certificates tool** from Start -> Microsoft WSE 3.0.
2. Select the **Certificate Location** and **Store Name** for your certificate.
3. Click **Open certificate** and select either the client or server certificate.
4. In the **Key identifiers** group you can now see the certificate key. Use the **Windows key identifier (Base64 Encoded)**.

## Configuring staging for the use of certificates

Now that you have installed and configured the certificates, adjust the staging settings in Kentico to use the certificates for authentication.

### Target server

On the target server, change the staging service authentication type:

1. Open the **Settings** application.
2. Select the **Versioning & Synchronization -> Staging** category.
3. Set the **Staging service authentication** setting to **X.509**.
4. Fill in the **Client key ID** and **Server key ID**.
5. Click **Save**.

### Source server

On the source server, adjust the settings of the target servers:

1. Open the **Staging** application.
2. Select the **Servers** tab.
3. Edit () the target servers.
4. Change the **Server authentication** to **X509** and copy the **Client** and **Server key ID's** from the target server.
5. **Save** the configuration.

The staging service now uses certificates during authentication.