title: Configure encryption and signing of WCF SOAP requests/responses using different X509 certificates
body: <p>Here is what we want:</p>
  
  <ol>
  <li>Client signs SOAP request using certificate A's private key</li>
  <li>Client encrypts SOAP request using certificate B's public key</li>
  <li>Server verifies signature using A's public key</li>
  <li>Server decrypts request using certificate B's private key</li>
  <li>Server does work</li>
  <li>Server signs SOAP response using certificate C's private key</li>
  <li>Server encrypts SOAP response using certificate D's public key</li>
  <li>Client verifies response signature using certificate C's public key</li>
  <li>Client decrypts response using certificate D's private key</li>
  </ol>
  
  <p>In addition to the message security described above, the client will use a SSL client certificate when communicating with the server.</p>
  
  <p>We've done some <a href="https://www.google.no/webhp?sourceid=chrome-instant&amp;ion=1&amp;espv=2&amp;ie=UTF-8#q=wcf%20encrypt%20and%20sign%20different%20certificates" rel="nofollow">googling</a> to try and figure out how to configure WCF for the scenario above, but we still have some problems.</p>
  
  <p>Some issues/questions:</p>
  
  <ul>
  <li>Are we correct in assuming that this is something that WCF does not support out of the box? And that there is no declarative way we could configure this in WCF XML configuration?</li>
  <li>We have read the article <a href="https://msdn.microsoft.com/en-us/library/ms729856(v=vs.110).aspx" rel="nofollow">How to: Use Separate X.509 Certificates for Signing and Encryption</a>, but we're a bit unsure as to how to interpret the article. Most importantly:</li>
  </ul>
  
  <blockquote>
    <p>The security binding element must operate in duplex mode to allow
    different security token providers to be present for requests and
    responses. One way to do this is to use a duplex-capable transport or
    to use the CompositeDuplexBindingElement as shown in the following
    code</p>
  </blockquote>
  
  <ul>
  <li>Now if I understand correctly, a WCF duplex binding would mean that our client would have to expose an endpoint that the server can call? Is this correct?</li>
  <li>If this is the case, how come WCF is this way? Why is it necessary to mess with the transport channels just to encrypt and sign messages in a particular way?</li>
  <li>Is there any way to accomplish the above without using WCF duplex mode communication?</li>
  </ul>
  
  <p>(If you wonder, this integration scenario is for transferring sensitive medical information)</p>