title: Self Signed Certificate and CertificateValidationMode on Windows XP only
body: <p>All my code is .Net 4.0.</p>
  
  <p>I have wcf service using certificate+username/password authentication. In my service I used a self signed certificate, so the public key loaded to client should go to <code>Trusted People</code> store. I am aware of that.</p>
  
  <p>I use a channel factory to open the connection.  My code looks like:</p>
  
  <pre><code>    public static ChannelFactory&lt;T&gt; CreateMyServiceClientChannel&lt;T&gt;(string serviceUrl, string serviceUsername, string servicePassword)
      {
          NetTcpBinding binding = new NetTcpBinding();
          binding.Security.Mode = SecurityMode.Message;
          binding.Security.Transport.ClientCredentialType = TcpClientCredentialType.Windows;
          binding.Security.Transport.ProtectionLevel = ProtectionLevel.EncryptAndSign;
          binding.Security.Message.ClientCredentialType = MessageCredentialType.UserName;
  
          X509Store store = new X509Store(StoreName.TrustedPeople, StoreLocation.LocalMachine);
          store.Open(OpenFlags.ReadOnly);
          X509Certificate2 clientCertificate = store.Certificates.OfType&lt;X509Certificate2&gt;().FirstOrDefault(cert =&gt; cert.Subject == "CN=MyServicesCert");
          store.Close();
  
          // Instantiate the EndPointAddress using the Service URL, endpoint identity
          Uri baseAddress = new Uri(serviceUrl);
          EndpointIdentity epi = EndpointIdentity.CreateX509CertificateIdentity(clientCertificate);
          EndpointAddress endpoint = new EndpointAddress(baseAddress, epi);
  
          // Create the Channel Factory instance using binding and end point variables. 
          ChannelFactory&lt;T&gt; channelFactory = new ChannelFactory&lt;T&gt;(binding, endpoint);
  
          // set credentials
          channelFactory.Credentials.UserName.UserName = serviceUsername;
          channelFactory.Credentials.UserName.Password = servicePassword;
  
          channelFactory.Credentials.ServiceCertificate.Authentication.CertificateValidationMode = X509CertificateValidationMode.None;
  
          // Return the channel factory
          return channelFactory;
      }
  </code></pre>
  
  <p>The question here is the 2nd to last statement:</p>
  
  <pre><code>channelFactory.Credentials.ServiceCertificate.Authentication.CertificateValidationMode = X509CertificateValidationMode.None; 
  </code></pre>
  
  <p>In my Windows 7 machine I don't have to include it, and I can communicate with service properly. However in Windows XP machine, if I don't include it I got exception</p>
  
  <blockquote>
    <p>System.ServiceModel.Security.SecurityNegotiationException: SOAP
    security negotiation with 'net.tcp://my-server:20800/my-service.svc'
    for target 'net.tcp://my-server:20800/my-service.svc' failed. See
    inner exception for more details. --->
    System.IdentityModel.Tokens.SecurityTokenValidationException: The
    X.509 certificate CN=MyServicesCert chain building failed. The
    certificate that was used has a trust chain that cannot be verified.
    Replace the certificate or change the certificateValidationMode. A
    certificate chain processed, but terminated in a root certificate
    which is not trusted by the trust provider.</p>
  </blockquote>
  
  <p>So it looks like .net behaves differently between Windows 7 and XP, how is that?</p>