title: WebHttpBinding Security Question
body: <p>I have created a RESTful Service and implemented the Authentication. It accepts username and password and then grants access to the service requested. It Works fine. Now I want to use SSL on top of my Service. For this I Created Certificate, Then In IIS I gave the required settings. But my service is not working. I am using webHttpBinding.</p>
  
  <p>my Web.Config on service side is :</p>
  
  <pre><code> &lt;serviceHostingEnvironment aspNetCompatibilityEnabled="true" /&gt;
  &lt;services&gt;
      &lt;service  behaviorConfiguration="ServiceBehavior" name="TestAPI"&gt;
        &lt;host&gt;
          &lt;baseAddresses&gt;
            &lt;add baseAddress="https://localhost/AuthWithSSLTest/API/TestAPI.svc" /&gt;
          &lt;/baseAddresses&gt;
        &lt;/host&gt;
      &lt;endpoint address="" behaviorConfiguration="RESTFriendly" bindingConfiguration="MywebHttpBinding"  binding="webHttpBinding" contract="ITestAPI" &gt;
        &lt;/endpoint&gt;
        &lt;endpoint address="mex" binding="mexHttpsBinding" contract="IMetadataExchange" /&gt;
    &lt;/service&gt;
  &lt;/services&gt;
  &lt;client /&gt;&lt;bindings&gt;
    &lt;webHttpBinding&gt;
      &lt;binding name="MywebHttpBinding"&gt;
        &lt;security mode="Transport" &gt;
         &lt;transport clientCredentialType="Certificate"/&gt;
        &lt;/security&gt; 
      &lt;/binding&gt;
    &lt;/webHttpBinding&gt;     
  &lt;/bindings&gt;
  &lt;behaviors&gt;
    &lt;endpointBehaviors&gt;
      &lt;behavior name="RESTFriendly"&gt;
        &lt;webHttp /&gt;
      &lt;/behavior&gt;
    &lt;/endpointBehaviors&gt;
    &lt;serviceBehaviors&gt;
      &lt;behavior name="ServiceBehavior"&gt;
        &lt;serviceMetadata httpGetEnabled="false" httpsGetEnabled="true" /&gt;
        &lt;serviceDebug includeExceptionDetailInFaults="true" /&gt;
        &lt;serviceCredentials&gt;
          &lt;clientCertificate&gt;
            &lt;authentication revocationMode="NoCheck" /&gt;
          &lt;/clientCertificate&gt;
          &lt;serviceCertificate findValue="CN=tempCertClient" /&gt;
        &lt;/serviceCredentials&gt;
      &lt;/behavior&gt;
    &lt;/serviceBehaviors&gt;
  &lt;/behaviors&gt;
  </code></pre>
  
  <p>And In my client side app.config I have </p>
  
  <pre><code>&lt;system.serviceModel&gt;
      &lt;behaviors&gt;
          &lt;endpointBehaviors&gt;
              &lt;behavior name="NewBehavior"&gt;
                  &lt;clientCredentials&gt;
                      &lt;clientCertificate findValue="CN=tempCertClient" storeLocation="LocalMachine" /&gt;
                      &lt;serviceCertificate&gt;
                          &lt;authentication certificateValidationMode="PeerTrust" revocationMode="NoCheck" /&gt;
                      &lt;/serviceCertificate&gt;
                  &lt;/clientCredentials&gt;
              &lt;/behavior&gt;
          &lt;/endpointBehaviors&gt;
      &lt;/behaviors&gt;
      &lt;bindings&gt;
          &lt;customBinding&gt;
              &lt;binding name="WebHttpBinding_ITestAPI"&gt;
  
                &lt;httpTransport/&gt;
              &lt;/binding&gt;
          &lt;/customBinding&gt;
      &lt;/bindings&gt;
      &lt;client&gt;
          &lt;endpoint address="https://localhost/AuthWithSSLTest/API/API.svc/TestMethod"
              behaviorConfiguration="NewBehavior" binding="customBinding"
              bindingConfiguration="WebHttpBinding_ITestAPI"
              contract="TestAPI.ITestAPI" name="WebHttpBinding_ITestAPI" /&gt;
      &lt;/client&gt;
  &lt;/system.serviceModel&gt;
  </code></pre>
  
  <p>When I try to Run Client, it says Provided URI scheme Https is invalid, http required.</p>
  
  <p>Also when I try to invoke the Web Service from VS2008, it says "Could not find a base address that matches scheme https for the endpoint with binding WebHttpBinding. Registered base address schemes are [http]." </p>
  
  <p>if I try to run the web service from IIS, it says "Could not find a base address that matches scheme http for the endpoint with binding WebHttpBinding. Registered base address schemes are [https]."</p>
  
  <p>I have tried googling and tried all the suggested things, but no awail. Please Help.</p>
  
  <p>Thanks in Advance,
  Tara Singh</p>