title: "Security settings for this service require Windows Authentication" IIS error for client certificates WCF project
body: <p>I've scoured the internet (and SO) for solutions to this. None of the questions that will appear in the RHS as of today solve my problem, so here goes.</p>
  
  <p><strong>TLDR:</strong> I'm trying to build a WCF service that requires client certificates, and I'm running into this error: </p>
  
  <blockquote>
    <p>Security settings for this service require Windows Authentication but
    it is not enabled for the IIS application that hosts this service.</p>
  </blockquote>
  
  <p>I had several problems getting the service to identify the self-signed certificate I generated for testing. It seems to be working now, because clients that don't have the certificate show me an IIS error of 403 (forbidden) instead of this exception.</p>
  
  <p>Relevant snippets of my service web.config:</p>
  
  <pre><code>&lt;wsHttpBinding&gt;
      &lt;binding name="clientCertificateBinding"&gt;
          &lt;security mode="Message"&gt;
              &lt;message clientCredentialType="Certificate" /&gt;
          &lt;/security&gt;
      &lt;/binding&gt;
  &lt;/wsHttpBinding&gt;
  </code></pre>
  
  <p>I have two end-points defined: one for "mex" (tried removing it, doesn't solve my problem) and one for the actual service. The service binding uses <code>binding="wsHttpBinding" bindingConfiguration="clientCertificateBinding"</code> as the specification.</p>
  
  <p>Later, I tell my behaviour to use the service certificate:</p>
  
  <pre><code>&lt;behavior name="AwesomeBehaviour"&gt;
      &lt;serviceMetadata httpsGetEnabled="true"/&gt;
      &lt;serviceCredentials&gt;
          &lt;serviceCertificate
          storeLocation="LocalMachine"
          storeName="My"
          findValue = 'CN=...' /&gt;
      &lt;/serviceCredentials&gt;
      &lt;serviceDebug includeExceptionDetailInFaults="true"/&gt;
  &lt;/behavior&gt;
  </code></pre>
  
  <p>Also, IIS is set to <strong>Rquire SSL and require client certificates.</strong> Not just accept them, but require them.</p>
  
  <p>I've tried (as some suggest) changing the security mode from <code>Transport</code> to <code>Message</code> and <code>TransportWithMessageCredential</code>; this doesn't do anything.</p>
  
  <p>There's also <a href="http://social.msdn.microsoft.com/Forums/en-US/wcf/thread/021babc6-2009-4ed9-81f4-ac48cc300c94/" rel="nofollow">this thread</a> which talks about NTLM and Negotiate as a transport credential type. This does not fix my problem.</p>
  
  <p>There's also <a href="http://support.microsoft.com/kb/215383" rel="nofollow">this KB article</a> which talks about <code>cscript.exe</code>. I installed the compatibility tools and added the NTLM authentication provider, to no avail.</p>
  
  <p>I'm not sure what I'm missing. </p>