title: Is a self-signed certificate secure enough?
body: <p>I have a WCF service that needs to be secured via https. The WCF service server site and the clients consuming the WCF service are both self developed.</p>
  
  <p>I generated a self-sign certificate and used it in my service with help from the following how-to article: <a href="http://msdn.microsoft.com/en-us/library/ff647171.aspx" rel="nofollow">http://msdn.microsoft.com/en-us/library/ff647171.aspx</a>.</p>
  
  <p>My service's binding and behavior configuration is as follows:</p>
  
  <pre><code>&lt;behaviors&gt;
    &lt;serviceBehaviors&gt;
      &lt;behavior name="SecureServiceBehavior"&gt;
        &lt;serviceMetadata httpGetEnabled="true" /&gt;
        &lt;serviceDebug includeExceptionDetailInFaults="false" /&gt;
        &lt;serviceCredentials&gt;
          &lt;serviceCertificate findValue="CN={my server's ip address}" /&gt;
          &lt;userNameAuthentication userNamePasswordValidationMode="MembershipProvider"
            membershipProviderName="SqlMembershipProvider" /&gt;
        &lt;/serviceCredentials&gt;
        &lt;serviceAuthorization principalPermissionMode="UseAspNetRoles"
          roleProviderName="SqlRoleProvider" /&gt;
          &lt;serviceThrottling maxConcurrentCalls="128"
                             maxConcurrentSessions="128"
                             maxConcurrentInstances="128" /&gt;
      &lt;/behavior&gt;
    &lt;/serviceBehaviors&gt;
  &lt;/behaviors&gt;
  &lt;bindings&gt;
    &lt;wsHttpBinding&gt;
      &lt;binding name="MyBinding"&gt;
         &lt;security mode="TransportWithMessageCredential"&gt;
            &lt;message clientCredentialType="UserName"/&gt;
         &lt;/security&gt;
      &lt;/binding&gt;
    &lt;/wsHttpBinding&gt;
  &lt;/bindings&gt;
  </code></pre>
  
  <p>All WCF clients are employees of our company that will access the system over the Internet by IP address. I will add the server's certificate to the trusted certificate authorities of each client computer.</p>
  
  <p>Is such a configuration secure enough?</p>