title: WCF and client certificate authentication
body: <p>Writing a web service client in C#/WCF and can't get the channel to authenticate. This is the error message that I get when I try to execute an API call:</p>
  
  <p><code>"Could not establish secure channel for SSL/TLS with authority 'www.redacted.com'."</code></p>
  
  <p>And the config file:</p>
  
  <pre><code>    &lt;behaviors&gt;
          &lt;endpointBehaviors&gt;
              &lt;behavior name="NewBehavior0"&gt;
                  &lt;clientCredentials&gt;
                      &lt;clientCertificate findValue="th um bp ri nt va lu e  go es he re"
                          x509FindType="FindByThumbprint" /&gt;
                  &lt;/clientCredentials&gt;
              &lt;/behavior&gt;
          &lt;/endpointBehaviors&gt;
      &lt;/behaviors&gt;
      &lt;bindings&gt;
          &lt;basicHttpBinding&gt;
              &lt;binding name="WsApiServiceSoapBinding" closeTimeout="00:01:00" openTimeout="00:01:00" receiveTimeout="00:10:00" sendTimeout="00:01:00" allowCookies="false" bypassProxyOnLocal="false" hostNameComparisonMode="StrongWildcard" maxBufferSize="65536" maxBufferPoolSize="524288" maxReceivedMessageSize="65536" messageEncoding="Mtom" textEncoding="utf-8" transferMode="Buffered" useDefaultWebProxy="true"&gt;
                  &lt;readerQuotas maxDepth="32" maxStringContentLength="8192" maxArrayLength="16384" maxBytesPerRead="4096" maxNameTableCharCount="16384"/&gt;
                  &lt;security mode="Transport"&gt;
                      &lt;transport clientCredentialType="None" proxyCredentialType="None" realm=""/&gt;
                      &lt;message clientCredentialType="UserName" algorithmSuite="Default"/&gt;
                  &lt;/security&gt;
              &lt;/binding&gt;
          &lt;/basicHttpBinding&gt;
      &lt;/bindings&gt;
      &lt;client&gt;
          &lt;endpoint address="https://www.&lt;redacted&gt;.com/services/WsApiService/"
              behaviorConfiguration="NewBehavior0" binding="basicHttpBinding"
              bindingConfiguration="WsApiServiceSoapBinding" contract="WsApiServicePortType"
              name="WsApiServicePort" /&gt;
      &lt;/client&gt;
  </code></pre>
  
  <p>The only thing I'm doing in the client code is executing a call to the getDoc method. The proxy class is auto-generated from a WSDL under WCF. I've verified that the certificate is installed in the Personal category in certmgr, is not expired, and is intended for all purposes. (I should note that this same cert worked just fine under WSE.) I've searched around and can't find anything that contradicts how it's currently configured.</p>
  
  <p>Any ideas? If you need to see some more code let me know and I'll post it ASAP.</p>