title: Enabling certificate based authentication for WCF service using netTcpBinding
body: <p>I have a WCF service which is exposed using a single endpoint with netTcpBinding which sits on <strong>Server A</strong>, hosted on IIS7.5/WAS on our internal LAN on our domain.</p>
  
  <p>This service is then consumed by an ASP.NET web client application sitting on <strong>Server B</strong>, also hosted on IIS7.5 with an external hosting provider outside of our domain, and linked to our LAN via a VPN secured to allow only traffic between <strong>Server A</strong> and <strong>Server B</strong>.</p>
  
  <p>During development while I was testing the concept I ran the web client application on another IIS server internally on our domain using binding security <code>mode="Transport"</code> and transport <code>clientCredentialType="Windows"</code> which worked fine.</p>
  
  <p>I then moved the web client application to the external <strong>Server B</strong> for further proof-of-concept testing setting the binding security <code>mode="None"</code>, as obviously with this server being outside of our domain I cannot use Windows authentication, and it still works fine.</p>
  
  <p>What I need to do now, to enable the switch back to using transport security is to set the <code>clientCredentialType="Certificate"</code>, as you cannot have transport security with <code>clientCredentialType="None"</code>.</p>
  
  <p>This is where I have started to come unstuck. I seem to be going around in circles as to where in the <code>web.config</code> of the service and the client <code>web.config</code> to define the certificate and where to store which bits of the certificate.</p>
  
  <p>Essentially what I'm trying to do is authenticate that <strong>Server B</strong> is indeed <strong>Server B</strong> calling the service on <strong>Server A</strong>, thus preventing any spoofing or DNS subversion issues, which could result in the service at <strong>Server A</strong> being illegally accessed.</p>
  
  <p>My thinking is that I need to create a certificate for <strong>Server B</strong> to which Server A holds the public key to validate it? If this is the case <strong>Server B</strong> already has a wildcard SSL certificate installed on it as it serves various applications of ours as subdomains. Could this certificate be used for the WCF authentication?</p>
  
  <p>None of the SO questions I've found seem to cover this, and all the various websites and book examples I've found aren't that clear. It's starting look like WCF configuration is somewhat of a black art.</p>
  
  <p>This is all built using .NET 4 and Visual Basic. Any help would be greatly appreciated.</p>