title: Disable SSL client certificate on *some* WebAPI controllers?
body: <blockquote>
    <p><strong><em>Edit for future readers</em></strong>: Unfortunately, the bounty awarded answer
    doesn't work; nothing I can do about that now. But read my own answer
    below (through testing) - confirmed to work with minimal code changes</p>
  </blockquote>
  
  <p>We have an Azure Cloud Service (WebRole) that's entirely in ASP.NET WebAPI 2.2 (no MVC, front end is Angular). Some of our controllers/REST endpoints talk to a 3rd party cloud service over SSL (client cert auth/mutual auth) and the rest of the controllers/endpoints  talk to the HTML5/AngularJS front end, also over SSL (but more traditional server auth SSL). We don't have any non-SSL endpoint. We've enabled Client SSL via a cloud service startup task like:</p>
  
  <pre><code>IF NOT DEFINED APPCMD SET APPCMD=%SystemRoot%\system32\inetsrv\AppCmd.exe
  %APPCMD% unlock config /section:system.webServer/security/access
  </code></pre>
  
  <p>Issue: That setting is site-wide so even when users hit the first page (say <a href="https://domain.com" rel="noreferrer">https://domain.com</a>, returns the index.html for angularJS) their browser asks them for client SSL cert. (image below)</p>
  
  <p>If there a way to either</p>
  
  <ol>
  <li>Limit the client SSL certificate requests to just the WebAPI controllers that talk to the 3rd party cloud service?</li>
  </ol>
  
  <p>OR</p>
  
  <ol start="2">
  <li>Skip client SSL auth for our front end powering webapi controllers?</li>
  </ol>
  
  <p>Our server's web.config is complex but the relevant snippet is below:</p>
  
  <pre><code>&lt;system.webServer&gt;
    &lt;security&gt;
      &lt;access sslFlags="SslNegotiateCert" /&gt;
    &lt;/security&gt;
  &lt;/system.webServer&gt;
  </code></pre>
  
  <p>And the screenshot of the client hitting a regular WebAPI endpoint yet attempting client SSL Authentication (happens in any browser, Chrome, Firefox or IE)
  <img src="https://i.stack.imgur.com/30XJo.png" alt="enter image description here"></p>