I'm using client certificates in SSL sessions to authenticate users, but I'm having a bit of a problem with cached sessions. (I have configured the web server to accept—not require—client certificates.)

I fixed this using this example: Clear SSL client certificate state from JavaScript

var xmlHttp = new XMLHttpRequest();
xmlHttp.onreadystatechange = function () {
    // put any actions to carry out upon logout here
};
xmlHttp.open( "GET", "/ssl_logout/", true );
xmlHttp.send();

and with an Apache24 config like this, mind the SSLVerifyDepth actually blocking every TLS request and forcing a renegotiation:

<Directory "/usr/local/users/local/xxxxxx/yyyy/htdocs/ssl_logout">
    SSLVerifyClient require
    SSLVerifyDepth  0
</Directory>

We are however on an II7 production environment and I would like to know how to do the same trick on IIS7: refusing all client certificates on a folder or file, and so dropping SSL and force renegotiation.

Or another (JavaScript) solution to forcefully reload my client certificate / SSL connection.