title: Custom WCF client certificate over ssl validation
body: <p>Hello, </p>
  
  <p>I am trying to use WCF to do some authentication: </p>
  
  <ul>
  <li>Authenticate the user using Username/Passoword</li>
  <li>Authenticate the client using a client certificate</li>
  <li>Customize which root certificate are accepted </li>
  </ul>
  
  <p>After some trial and error, i managed to get points 1 &amp; 2 working, but i am stuck on 3. This is my service configuration</p>
  
  <pre class="lang-html prettyprint-override"><code>&lt;system.serviceModel&gt;
      &lt;behaviors&gt;
          &lt;endpointBehaviors /&gt;
          &lt;serviceBehaviors&gt;
              &lt;behavior name="MyBehavior"&gt;
                  &lt;serviceCredentials&gt;
                      &lt;userNameAuthentication userNamePasswordValidationMode="Custom"
                                              customUserNamePasswordValidatorType="WcfService1.CustomValidator, WcfService1" /&gt;
                  &lt;/serviceCredentials&gt;                    
                  &lt;serviceMetadata httpsGetEnabled="true" httpGetEnabled="false" /&gt;
                  &lt;serviceDebug includeExceptionDetailInFaults="true" /&gt;
              &lt;/behavior&gt;
          &lt;/serviceBehaviors&gt;
      &lt;/behaviors&gt;
      &lt;bindings&gt;
          &lt;customBinding&gt;
              &lt;binding name="certificate"&gt;
                  &lt;security authenticationMode="UserNameOverTransport" /&gt;
                  &lt;textMessageEncoding messageVersion="Soap12WSAddressing10" /&gt;
                  &lt;httpsTransport requireClientCertificate="true" /&gt;
              &lt;/binding&gt;
          &lt;/customBinding&gt;
      &lt;/bindings&gt;
      &lt;services&gt;
          &lt;service behaviorConfiguration="MyBehavior" name="WcfService1.Service1"&gt;
              &lt;endpoint address="" binding="customBinding" bindingConfiguration="certificate"
                        contract="WcfService1.IService1" /&gt;
          &lt;/service&gt;
      &lt;/services&gt;
  &lt;/system.serviceModel&gt;
  </code></pre>
  
  <p>and this is my client configuration </p>
  
  <pre class="lang-html prettyprint-override"><code>    &lt;client&gt;
          &lt;endpoint name="service1" address="https://localhost:443/WcfService1/Service1.svc" binding="customBinding"
                    bindingConfiguration="certificate" behaviorConfiguration="certificate" contract="WcfService1.IService1" /&gt;
      &lt;/client&gt;
      &lt;behaviors&gt;
          &lt;endpointBehaviors&gt;
              &lt;behavior name="certificate"&gt;
                  &lt;clientCredentials&gt;
                      &lt;clientCertificate storeName="My" storeLocation="LocalMachine" x509FindType="FindBySubjectName"
                                         findValue="SignedByCA" /&gt;
                  &lt;/clientCredentials&gt;
              &lt;/behavior&gt;
          &lt;/endpointBehaviors&gt;
          &lt;serviceBehaviors /&gt;
      &lt;/behaviors&gt;
      &lt;bindings&gt;
          &lt;customBinding&gt;
              &lt;binding name="certificate"&gt;
                  &lt;security authenticationMode="UserNameOverTransport" /&gt;
                  &lt;textMessageEncoding messageVersion="Soap12WSAddressing10" /&gt;
                  &lt;httpsTransport requireClientCertificate="true" /&gt;
              &lt;/binding&gt;
          &lt;/customBinding&gt;
      &lt;/bindings&gt;
  </code></pre>
  
  <p>Using the  client and attaching username credentials works nicely</p>
  
  <pre class="lang-cs prettyprint-override"><code>var channelFactory = new ChannelFactory&lt;IService1&gt;("service1");
  var user = channelFactory.Credentials.UserName;
  user.UserName = username;
  user.Password = password;
  </code></pre>
  
  <p>Using OperationContext.Current.ServiceSecurityContext.AuthorizationContext.ClaimSets gives me access to the username and the name and thumbprint of the certificate. Sadly, i am unable to find the IssuerName of the certificate. How else can I disallow clients that do not have a certificate issued by a certain root certificate?</p>
  
  <p>Any hints to point me into the right direction or any alternatives are greatly welcome ;)</p>
  
  <p>Thanks</p>