title: WCF Service Certificate - how to manage certificate expiry
body: <p>I have a WCF service that uses a certificate in the following way:</p>
  
  <pre><code>Credentials.ServiceCertificate.SetCertificate(System.Security.Cryptography.X509Certificates.StoreLocation.LocalMachine, _
                                                  System.Security.Cryptography.X509Certificates.StoreName.TrustedPeople, _
                                                  System.Security.Cryptography.X509Certificates.X509FindType.FindByThumbprint, _
                                                  serviceCertificateThumbprint)
  </code></pre>
  
  <p>The client also has the certificate installed and looks it up using the thumbprint. To enable the certificates to be deployed, and updated, the thumbprint on the client and server are stored in the database, and the certificate is looked up on the fly. I am using an internally issued certificate. However, the certificate I currently have is set to expire in a few months, and I am wondering what is the recommended best practice for managing certificate expiry? The service is called by 4 clients I manage, but also by a large number of other clients out of my control, therefore distributing certificates using Group Policy is not necessarily appropriate. </p>
  
  <p>1) Is it possible to configure the service with multiple endpoints, secured by different certificates to allow for an overlap period so that all clients have time to reconfigure with the newly issued certificate?</p>
  
  <p>2) Given that these applications are largely internal, is it appropriate to use:</p>
  
  <pre><code>X509CertificateValidationMode.None
  X509RevocationMode.NoCheck
  </code></pre>
  
  <p>?</p>
  
  <p>3) Is it necessary to use certificates, given the service is also secured using WIF/STS? if not, how is this done? ( i believe that if certificates aren't used, then https must be)</p>