How to require X.509 certificate authentication in ASP.NET MVC?

There's plenty of material on how to authenticate using an X.509 certificate via HttpWebRequest from the client side, but no certificate is actually sent because the server does issue the challenge to the client to send it. How can I configure an ASP.NET MVC site to require an X.509 client certificate for certain MVC actions?

Note, I've see开发者_运维百科n X.509 client auth configurations in IIS, but I don't want to always require X.509 -- just on certain actions.

AFAIAA, HTTPS handshake is always handled by IIS/Windows, you do not control it from your application. The only possible way is to have a specially configured part of your application which is set to require client certificate, and the rest without it. Then, when you want the user to submit his/her certificate, redirect them to that page in the special part (which will probably just store/validate the received certificate and redirect back).