title: Is TransportWithMessageCredential without certificate secure enough for a WCF service?
body: <p>I have developed a WCF self-hosted service, for which I have two basic security requirements as it will be accessed over the Internet:</p>
  
  <ul>
  <li><p>The transport layer should prevent tampering and sniffing, especially the retrieval of authentication credentials. This is what SSL does, but from what I have seen setting up SSL requires the installation of certificates (except maybe through <a href="http://www.codeproject.com/Articles/96028/WCF-Service-with-custom-username-password-authenti">this hack</a> that uses plain certificate files), which I prefer not to have to do.</p></li>
  <li><p>The authentication layer should consist of a username/password validator.</p></li>
  </ul>
  
  <p>I configured my service to use:</p>
  
  <pre><code>      &lt;security mode="TransportWithMessageCredential"&gt;
          &lt;message clientCredentialType="UserName" /&gt;
          &lt;transport clientCredentialType="Basic" /&gt;
        &lt;/security&gt;
  </code></pre>
  
  <p>Even if the transport layer is HTTP (not HTTPS), does this make WCF create another security layer that is equivalent to SSL? If not, what is the difference in terms of security strength?</p>
  
  <p>Also, is there any way to secure the meta data endpoint without using a SSL certificate (not essential but would be appreciated)?</p>
  
  <p>Here is my full configuration code for the self-hosted service:</p>
  
  <pre><code>&lt;?xml version="1.0"?&gt;
  &lt;configuration&gt;
  &lt;startup&gt;&lt;supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.0"/&gt;&lt;/startup&gt;
    &lt;system.serviceModel&gt;
      &lt;services&gt;
        &lt;service name="MyService"&gt;
          &lt;host&gt;
            &lt;baseAddresses&gt;
              &lt;add baseAddress = "http://localhost:8000/Services" /&gt;
            &lt;/baseAddresses&gt;
          &lt;/host&gt;
          &lt;endpoint address ="MyService" binding="wsHttpBinding" contract="IMyService"&gt;
            &lt;identity&gt;
              &lt;dns value="localhost"/&gt;
            &lt;/identity&gt;
          &lt;/endpoint&gt;
          &lt;endpoint address="mex" binding="mexHttpBinding" contract="IMetadataExchange"/&gt;
        &lt;/service&gt;
      &lt;/services&gt;
      &lt;bindings&gt;
        &lt;wsHttpBinding&gt;
          &lt;binding name="Binding1" maxReceivedMessageSize="2147483647"&gt;
            &lt;security mode="TransportWithMessageCredential"&gt;
              &lt;message clientCredentialType="UserName" /&gt;
              &lt;transport clientCredentialType="Basic" /&gt;
            &lt;/security&gt;
          &lt;/binding&gt;
        &lt;/wsHttpBinding&gt;
      &lt;/bindings&gt;
      &lt;behaviors&gt;
        &lt;serviceBehaviors&gt;
          &lt;behavior&gt;
            &lt;serviceMetadata httpGetEnabled="True"/&gt;
            &lt;serviceCredentials&gt;
              &lt;userNameAuthentication userNamePasswordValidationMode="Custom" customUserNamePasswordValidatorType="CR.Common.Services.CustomValidator, Common" /&gt;
            &lt;/serviceCredentials&gt;
          &lt;/behavior&gt;
        &lt;/serviceBehaviors&gt;
      &lt;/behaviors&gt;
    &lt;/system.serviceModel&gt;
  &lt;/configuration&gt;
  </code></pre>
  
  <p>Thank you!</p>