title: WCF certificate chain trust authentication: "The caller was not authenticated by the service."
body: <p>I would like to use certificate-based encryption and verification when communicating with a WCF service. So I created test certificates, "TempCA" as my root CA and "SignedByCA" as a client certificate signed by that CA.</p>
  
  <p>When I put the client certificate in "Local Computer\Trusted People" and use <code>certificateValidationMode="PeerTrust"</code>, the service recognizes the client and everything works as expected. But with trust chain verification (<code>certificateValidationMode="ChainTrust"</code>), I run into the error "The caller was not authenticated by the service".</p>
  
  <p><strong>Relevant server-side config:</strong></p>
  
  <pre><code>&lt;behaviors&gt;
        &lt;serviceBehaviors&gt;
          &lt;behavior name="customServiceBehavior"&gt;
              [...]
              &lt;serviceCredentials&gt;
                  &lt;clientCertificate&gt;
                      &lt;authentication certificateValidationMode="ChainTrust" trustedStoreLocation="LocalMachine" mapClientCertificateToWindowsAccount="false"  /&gt;
                  &lt;/clientCertificate&gt;
                  &lt;serviceCertificate findValue="TempCA"
                                      storeLocation="LocalMachine"
                                      storeName="My"
                                      x509FindType="FindBySubjectName" /&gt;
              &lt;/serviceCredentials&gt;
          &lt;/behavior&gt;
        &lt;/serviceBehaviors&gt;
      &lt;/behaviors&gt;
      &lt;bindings&gt;
          &lt;wsHttpBinding&gt;
              &lt;binding name="soapBindingConfiguration"&gt;
                  &lt;security mode="Message"&gt;
                      &lt;message clientCredentialType="Certificate" /&gt;
                  &lt;/security&gt;
              &lt;/binding&gt;
          &lt;/wsHttpBinding&gt;
      &lt;/bindings&gt;
  </code></pre>
  
  <p><strong>Relevant client config</strong> (rest auto-created by "Add Service Reference"):</p>
  
  <pre><code>&lt;endpointBehaviors&gt;
      &lt;behavior name="customClientBehavior"&gt;
          &lt;clientCredentials&gt;
              &lt;clientCertificate findValue="SignedByCA" storeLocation="LocalMachine" storeName="My" x509FindType="FindBySubjectName" /&gt;
          &lt;/clientCredentials&gt;
      &lt;/behavior&gt;
  &lt;/endpointBehaviors&gt;
  </code></pre>
  
  <p>Both client and server certificates are stored with their private key in "Local Computer\Personal" (because I'm testing on <em>one</em> computer), and the "TempCA" (my root certificate) is also in "Local Computer\Trusted Root Certificate Authorities".</p>
  
  <p>What am I missing here? Any working examples?</p>