title: Why a Private Key of Certificate needed at Client Application While Consuming a WCF Service?
body: <p><strong>Scenario</strong> </p>
  
  <p><strong>X.509 Certificate:</strong> a certificate is provided by the organization for server-client authentication. That certificate serves both purpose server and client authentication.</p>
  
  <p><strong>WCF Service:</strong> a WCF service is hosted in IIS up and running on a dev server. It secured by an X.509 pfx certificate (provided by organization, not self-signed). It uses message security in its config. <code>.Pfx</code> cert is successfully imported on the dev server via mmc at Local Computer in Personal-> Certificate and Trusted Root Certification Authorities-> Certificate</p>
  
  <p><strong>Client:</strong> it uses the same binding structure as the service. The <code>.cer</code> file (of same certificate used on the dev server) is imported at my local in in Personal-> Certificate and Trusted Root Certification Authorities-> Certificate.</p>
  
  <p><strong>Service config:</strong></p>
  
  <pre><code>&lt;system.serviceModel&gt;
      &lt;serviceHostingEnvironment multipleSiteBindingsEnabled="true" 
              minFreeMemoryPercentageToActivateService="0" /&gt;
      &lt;services&gt;
          &lt;service name="WCF_HOST.Service1" behaviorConfiguration="customBehaviour"&gt;
              &lt;host&gt;
                  &lt;baseAddresses&gt;
                      &lt;add baseAddress = "http://localhost:57104/Service1" /&gt;
                      &lt;!--&lt;add baseAddress = "http://****:57104/Service1" /&gt;--&gt;
                 &lt;/baseAddresses&gt;
              &lt;/host&gt;
              &lt;endpoint
                  address=""
                  binding="wsHttpBinding"
                  bindingConfiguration="customWsHttpBinding"
                  contract="WCF_HOST.IService1"&gt;
              &lt;/endpoint&gt;
              &lt;endpoint 
                  address="mex" binding="mexHttpBinding" 
                  contract="IMetadataExchange"/&gt;
          &lt;/service&gt;
      &lt;/services&gt;
      &lt;bindings&gt;
          &lt;wsHttpBinding&gt;
              &lt;binding name="customWsHttpBinding"&gt;
                  &lt;security mode="Message"&gt;
                      &lt;message clientCredentialType="Certificate"/&gt;
                  &lt;/security&gt;
                  &lt;!--&lt;readerQuotas
                         maxDepth="2147483647"
                         maxStringContentLength="2147483647"
                         maxArrayLength="2147483647"
                         maxBytesPerRead="2147483647"
                         maxNameTableCharCount="2147483647" /&gt;--&gt;
              &lt;/binding&gt;
          &lt;/wsHttpBinding&gt;
      &lt;/bindings&gt;
      &lt;behaviors&gt;
          &lt;serviceBehaviors&gt;
              &lt;behavior name="customBehaviour"&gt;
                  &lt;serviceMetadata httpGetEnabled="True"/&gt;
                  &lt;serviceDebug includeExceptionDetailInFaults="False" /&gt;
                  &lt;serviceCredentials&gt;
                       &lt;serviceCertificate findValue="tempCert"
                               storeLocation="LocalMachine" storeName="My"
                               x509FindType="FindBySubjectName" /&gt;
                       &lt;clientCertificate&gt;
                           &lt;authentication certificateValidationMode="PeerOrChainTrust" 
                               revocationMode="NoCheck" /&gt;
                       &lt;/clientCertificate&gt;
                  &lt;/serviceCredentials&gt;
              &lt;/behavior&gt;
          &lt;/serviceBehaviors&gt;
      &lt;/behaviors&gt;
  &lt;/system.serviceModel&gt;
  </code></pre>
  
  <p><strong>Client config:</strong></p>
  
  <pre><code>&lt;system.serviceModel&gt;
      &lt;bindings&gt;
        &lt;wsHttpBinding&gt;
          &lt;binding name="customWsHttpBinding"&gt;
            &lt;security mode="Message"&gt;
              &lt;message clientCredentialType="Certificate" negotiateServiceCredential="true"/&gt;
            &lt;/security&gt;
          &lt;/binding&gt;
        &lt;/wsHttpBinding&gt;
      &lt;/bindings&gt;
      &lt;client&gt;
        &lt;endpoint 
          address="http://****:57104/Service1.svc" 
          binding="wsHttpBinding" 
          bindingConfiguration="customWsHttpBinding" 
          behaviorConfiguration="customBehavior" 
          contract="ServiceClient.IService1"&gt;
          &lt;identity&gt;
            &lt;dns value="tempCert"/&gt;
          &lt;/identity&gt;
        &lt;/endpoint&gt;
      &lt;/client&gt;
      &lt;behaviors&gt;
        &lt;endpointBehaviors&gt;
          &lt;behavior name="customBehavior"&gt;
            &lt;clientCredentials&gt;
              &lt;serviceCertificate&gt;
                &lt;defaultCertificate findValue="he f5 l9 f9 41 e1 f5 ea 20 ef 55 bc 99 4c ca 5b c4 c5 31 d9" storeLocation="LocalMachine" storeName="My" x509FindType="FindByThumbprint"/&gt;
                &lt;authentication certificateValidationMode="PeerOrChainTrust" revocationMode="NoCheck"/&gt;
              &lt;/serviceCertificate&gt;
              &lt;clientCertificate 
                findValue="tempCert"
                storeLocation="CurrentUser" 
                storeName="My" x509FindType="FindBySubjectName"/&gt;
            &lt;/clientCredentials&gt;
          &lt;/behavior&gt;
        &lt;/endpointBehaviors&gt;
      &lt;/behaviors&gt;
    &lt;/system.serviceModel&gt;
  </code></pre>
  
  <p><strong>Certificate description</strong></p>
  
  <p><a href="https://i.stack.imgur.com/1I3KK.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/1I3KK.png" alt="enter image description here"></a></p>
  
  <p><strong>Questions</strong> </p>
  
  <ol>
  <li><p>When I try to consume the service at <code>webmethod</code> invocation it throws an exception </p>
  
  <blockquote>
    <p>The certificate 'CN=tempCert, OU=***19, O=****Inc., C=SG' must have a private key. The process must have access rights for the private key</p>
  </blockquote>
  
  <p>Why does the client application expect a private key here?</p></li>
  <li><p>If I provide the same <code>.pfx</code> certificate (used on the server) to the client app, it worked. How and why?</p></li>
  <li><p>Wasted umpteen hours on the issue, any help/advice greatly appreciated. </p></li>
  </ol>