title: How to set WCF security to require client certificate?
body: <p>I have WCF service. I demand clients to authenticate with certificate.
  This is service configuration:</p>
  
  <pre><code>&lt;system.serviceModel&gt;
          &lt;services&gt;
              &lt;service name="FilmLibrary.FilmManager" behaviorConfiguration="FilmService.Service1Behavior"&gt;
                  &lt;endpoint address="manager" name="certBinding" binding="basicHttpBinding" contract="FilmContract.IFilmManager" /&gt;
              &lt;/service&gt;            
          &lt;/services&gt;
          &lt;bindings&gt;
              &lt;basicHttpBinding&gt;
                  &lt;binding name="certBinding"&gt;
                      &lt;security mode="Message"&gt;
                          &lt;message clientCredentialType="Certificate" /&gt;
                      &lt;/security&gt;
                  &lt;/binding&gt;
              &lt;/basicHttpBinding&gt;
          &lt;/bindings&gt;
          &lt;behaviors&gt;
              &lt;serviceBehaviors&gt;
                  &lt;behavior name="FilmService.Service1Behavior"&gt;
                      &lt;serviceCredentials&gt;
                          &lt;clientCertificate&gt;
                              &lt;authentication trustedStoreLocation="LocalMachine" 
                              certificateValidationMode="PeerTrust" /&gt;
                          &lt;/clientCertificate&gt;                                               
                      &lt;/serviceCredentials&gt;    
              &lt;/behavior&gt;
              &lt;/serviceBehaviors&gt;
          &lt;/behaviors&gt;
      &lt;/system.serviceModel&gt;
  &lt;/configuration&gt;
  </code></pre>
  
  <p>Public key is installed in LocalMachine, Trusted People</p>
  
  <p>Client configuration is as follows:</p>
  
  <pre><code>&lt;system.serviceModel&gt;
          &lt;bindings&gt;
              &lt;basicHttpBinding&gt;
                  &lt;binding name="certBinding" closeTimeout="00:01:00" openTimeout="00:01:00"
                      receiveTimeout="00:10:00" sendTimeout="00:01:00" allowCookies="false"
                      bypassProxyOnLocal="false" hostNameComparisonMode="StrongWildcard"
                      maxBufferSize="65536" maxBufferPoolSize="524288" maxReceivedMessageSize="65536"
                      messageEncoding="Text" textEncoding="utf-8" transferMode="Buffered"
                      useDefaultWebProxy="true"&gt;
                      &lt;readerQuotas maxDepth="32" maxStringContentLength="8192" maxArrayLength="16384"
                          maxBytesPerRead="4096" maxNameTableCharCount="16384" /&gt;
                      &lt;security mode="Message"&gt;
                          &lt;message clientCredentialType="Certificate"/&gt;
                      &lt;/security&gt;
                  &lt;/binding&gt;
              &lt;/basicHttpBinding&gt;
          &lt;/bindings&gt;
          &lt;behaviors&gt;
              &lt;endpointBehaviors&gt;
                  &lt;behavior name="certBehaviour"&gt;
                      &lt;clientCredentials&gt; 
                          &lt;clientCertificate findValue="SubjectKey" storeLocation="CurrentUser" storeName="My" x509FindType="FindBySubjectName"/&gt;
                      &lt;/clientCredentials&gt;
                  &lt;/behavior&gt;
              &lt;/endpointBehaviors&gt;
          &lt;/behaviors&gt;
          &lt;client&gt;
              &lt;endpoint address="[...]/Service1.svc/manager"
                  binding="basicHttpBinding" bindingConfiguration="certBinding" behaviorConfiguration="certBehaviour"
                  contract="FilmsService.IFilmManager" name="certBinding" /&gt;
          &lt;/client&gt;
      &lt;/system.serviceModel&gt;
  </code></pre>
  
  <p>Private key is installed in Personal, current user.</p>
  
  <p>Without security, service works. With security enabled - it does not. I tried several configurations and I got errors like authentication failed or that I have to set service certificate in clientCredentials element. Which I don't understand because I do not want to authenticate service at all.</p>