A certificate is a "digital key" installed on a computer. When the computer tries to access a server, the key will be automatically presented to authenticate the user. Client certificates can be mapped to Windows accounts in either a Domain or Active Directory. If we use the Windows Authentication Provider in ASP.NET, the application thread will run only for the user to whom the certificate is being mapped.

For example, we can use the e-mail address (or a similarly unique field) contained within the certificate
And also from the client's perspective, security is seamless as the client is not required to log in using a logon page. This makes certificates an attractive option for automated business processes.

We use Certificate authentication when:

• The data we are protecting is considered very sensitive and we require a very secure solution.


• We want a third party to be able to manage the relationship between the server and the certificate holder.


• We want the client interaction to be seamless; for example, for an automated B2B exchange.


• We required mutual authentication.


• When the cost of issuing and managing client certificates outweighs the value of the added security then Certificate authentication do not consider.

Deployment:
For the client workstation, the client certificate should be physically deployed. There are different methods of doing this, ranging from a Web deployment to installing the certificate from a CD-ROM. The deployment issues are generally the reason why certificates are not as common as other authentication modes that are used in conjunction with SSL.

It is possible to map certificates to Domain or Active Directory accounts. If we want to authenticate individual users, we can use a technique known as one-to-one mappingmany-to-one mapping where, for example, any certificate containing a common company name is mapped to a single account.
where a certificate is mapped to an individual account. There is no limit on one-to-one mapping if you use Active Directory mapping. If we want to authenticate all of the users from a particular group or organization, we can use

Note:- For implementation of Certificate authentication it is required to configure IIS.