title: Using client certificates for authentication
body: <p>The client machine has the "TicketSalesClient" certificate in "My" storage of current user and the "TicketSalesServer" certificate in "TrustedPeople" storage of current user. The server machine has "TicketSalesClient" certificate in "TrustedPeople" storage of local machine and the "TicketSalesServer" certificate in "My" storage of local machine.</p>
  
  <p>The service runs under IIS 7. Below is the web.config file:</p>
  
  <pre><code>&lt;system.serviceModel&gt; 
  &lt;services&gt;
    &lt;service behaviorConfiguration="secureBehavior" name="InternetRailwayTicketSales.TicketSalesImplementations.TicketSalesService"&gt;
      &lt;endpoint address="TicketSalesService" 
                binding="basicHttpBinding" 
                bindingConfiguration="secureHttpBinding" contract="InternetRailwayTicketSales.TicketSalesInterface.ITicketSales" /&gt;
  
      &lt;endpoint address="TicketSalesServiceSecureMex" 
                binding="basicHttpBinding" 
                bindingConfiguration="secureHttpBinding" 
                contract="IMetadataExchange" /&gt;
  
      &lt;host&gt;
        &lt;baseAddresses&gt;
          &lt;add baseAddress="https://localhost:443/TicketSales/" /&gt;            
        &lt;/baseAddresses&gt;
      &lt;/host&gt;
  
    &lt;/service&gt;
  &lt;/services&gt;
  &lt;bindings&gt;
    &lt;basicHttpBinding&gt;
      &lt;binding name="secureHttpBinding"&gt;
        &lt;security mode="Transport"&gt;
          &lt;transport clientCredentialType="Certificate"/&gt;
        &lt;/security&gt;
      &lt;/binding&gt;
    &lt;/basicHttpBinding&gt;
  &lt;/bindings&gt;
  
  &lt;behaviors&gt;
    &lt;serviceBehaviors&gt;
      &lt;behavior name="secureBehavior"&gt;
        &lt;serviceThrottling maxConcurrentInstances="5000" maxConcurrentSessions="5000" /&gt;
        &lt;serviceMetadata httpsGetEnabled="true" /&gt;
        &lt;serviceDebug includeExceptionDetailInFaults="True" /&gt;
        &lt;serviceCredentials&gt;
          &lt;serviceCertificate findValue="TicketSalesServer" 
                              storeLocation="LocalMachine"
                              storeName="My"
                              x509FindType="FindBySubjectName"/&gt;
          &lt;clientCertificate&gt;
            &lt;authentication certificateValidationMode="PeerTrust"/&gt;
          &lt;/clientCertificate&gt;
        &lt;/serviceCredentials&gt;
      &lt;/behavior&gt;
    &lt;/serviceBehaviors&gt;
  &lt;/behaviors&gt;
  </code></pre>
  
  <p></p>
  
  <p>The service in IIS is configured for SSL and certificate requiring.</p>
  
  <p>1)Now when I try to add service reference in the client I receieve: "The HTTP request was forbidden with client authentication scheme 'Anonymous'. The remote server returned an error: (403) Forbidden."</p>
  
  <p>2)If I try to request the metadata endpoint using browser I firstly apply the SSL certificate and then receieve an error that "The credentials do not give the right to view this directory or page." As I understand this is because I can't give the client credentials through the browser.</p>
  
  <p>3)I tried to use svcutil with configuration file which contains client credentials:</p>
  
  <pre><code>    &lt;configuration&gt;
    &lt;system.serviceModel&gt;
      &lt;client&gt;
        &lt;endpoint 
          behaviorConfiguration="ClientCertificateBehavior"
          binding="basicHttpBinding"
          bindingConfiguration="Binding1" 
          contract="IMetadataExchange"
          name="https" /&gt;
      &lt;/client&gt;
      &lt;bindings&gt;
        &lt;basicHttpBinding&gt;
          &lt;binding name="Binding1"&gt;
            &lt;security mode="Transport"&gt;
              &lt;transport clientCredentialType="Certificate" /&gt;
            &lt;/security&gt;
          &lt;/binding&gt;
        &lt;/basicHttpBinding&gt;
      &lt;/bindings&gt;
      &lt;behaviors&gt;
        &lt;endpointBehaviors&gt;
          &lt;behavior name="ClientCertificateBehavior"&gt;
            &lt;clientCredentials&gt;
              &lt;clientCertificate findValue="TicketSalesClient"
                                 storeLocation="CurrentUser"
                                 storeName="My"
                                 x509FindType="FindBySubjectName" /&gt;
            &lt;/clientCredentials&gt;
          &lt;/behavior&gt;
        &lt;/endpointBehaviors&gt;
      &lt;/behaviors&gt;
    &lt;/system.serviceModel&gt;
      &lt;/configuration&gt;
  </code></pre>
  
  <p>And then:</p>
  
  <p>svcutil <a href="https://veryLongAddress.svc?wsdl" rel="nofollow">https://veryLongAddress.svc?wsdl</a> /config:svcutilConf.config</p>
  
  <p>And the response is that the "The underlying connection was closed: Could not establish trust relationship for the SSL/TLS secure channel. The remote certificate is invalid according to the validation procedure"</p>
  
  <p>So what am I doing wrong?</p>