I am developing a WCF service. I use WsHttpBinding and customUserNameValidator for access through username and password. But I've faced with problem that as soon as I use username/password I need some sort of secure channel that means that I should generate two certificates - one for the service and one for a client. The question is - is it possible to do so that client is not needed certificate and if yes - how to do that? And how to customize a security of WCF service for non-.net clients?