title: WCF Restful Service with Service certificate
body: <p>I have develop a securized WCF Service with wsHttpBinding using ssl and a <strong><em>SERVICE certificate</em></strong> (not a client certificate, but a service one!). Only clients storing the self signed certificate in their certificate store will be allowed to consume the service.</p>
  
  <p>I used a configuration similar as :</p>
  
  <pre><code>&lt;security mode="Transport"&gt;
    &lt;transport clientCredentialType="None" /&gt;
     &lt;message clientCredentialType="None" negotiateServiceCredential="true" /&gt;
  &lt;/security&gt;
  
  &lt;behaviors&gt;
      &lt;serviceBehaviors&gt;
      &lt;behavior name="CertificateServiceBehavior"&gt;
              &lt;serviceCredentials&gt;
  ...
                  &lt;serviceCertificate storeLocation="LocalMachine" storeName="My" x509FindType="FindBySubjectName" findValue="server" /&gt;
              &lt;/serviceCredentials&gt;
  ...
          &lt;/behavior&gt;
      &lt;/serviceBehaviors&gt;
  &lt;/behaviors&gt;
  </code></pre>
  
  <hr>
  
  <p>I am quite new to WCF Securisation. I've search a lot a bout securisation but i need you to help me out with my questions.</p>
  
  <p>Today I was asked to securize a WCF Restful service.<br>
  Looking over internet I have found that we could :</p>
  
  <ul>
  <li>use ssl</li>
  <li>authenticate client with Credential (using  => Certificate =
  Client Certificate)</li>
  </ul>
  
  <p>My questions are:</p>
  
  <p>a) From my first example at the beginning, I have assumed that when we setup a service certificate, this isto securize a wcf service at the <strong>message</strong> level
  (in comparaison with transport, as ssl is taking care of transport). 
  Please correct me if i am wrong ?</p>
  
  <p>b) For WCF Restful Service, the binding we use is WebHttpBinding.
  According to <a href="http://msdn.microsoft.com/fr-fr/library/bb412176%28v=vs.110%29.aspx" rel="nofollow">http://msdn.microsoft.com/fr-fr/library/bb412176%28v=vs.110%29.aspx</a>
  there is no   element under :</p>
  
  <pre><code> &lt;security mode="None/Transport/TransportCredentialOnly"&gt;
      // here there is only &lt;transport&gt; available with clientCredential="certificate" available.
   &lt;/security&gt;
  </code></pre>
  
  <p>So, could we setup a <strong>service certificate</strong> for a restful Service?</p>
  
  <p>Thanks for helping !</p>