title: WCF service certificate and client side endpoint identity - why it doesn't work?
body: <p>[Update] - I attach also full config files, for <a href="http://gist.github.com/230024" rel="nofollow noreferrer">service</a>, and for <a href="http://gist.github.com/230026" rel="nofollow noreferrer">client</a> (outside of here, not to flood the topic)</p>
  
  <p>I'm having situation pretty much identical to the one outlined in <a href="https://stackoverflow.com/questions/1577115/wcf-service-certificate-implications-of-certificatevalidationmodenone-and-revo">this</a> question, however my question is somewhat different.</p>
  
  <ul>
  <li>I'm using NetTcpBinding with security
  set to TransportWithMessageCredential</li>
  <li>I'm using Password/Username
  credentials backed up by ASP.NET
  provider</li>
  <li>My service is self hosted in Windows
  Service</li>
  <li>I <strong>do</strong> have in my endpoint behavior
  specified authentication
  revocationMode="NoCheck"</li>
  </ul>
  
  <p>It is required that the service provides a certificate to authenticate itself to clients. That's OK, I just do:</p>
  
  <pre><code>&lt;serviceCertificate findValue="***"
                      storeLocation="CurrentUser"
                      storeName="My"
                      x509FindType="FindByThumbprint"/&gt;
  </code></pre>
  
  <p>Now, I somewhat imagined that now the client would end up having</p>
  
  <pre><code>&lt;identity&gt;
    &lt;certificate encodedValue="encoded certificate"/&gt;
  &lt;/identity&gt;
  </code></pre>
  
  <p>And it will be able to verify service's credentials <strong>without having that certificate installed in the store on client machine</strong>.</p>
  
  <p>I was surprised <a href="http://msdn.microsoft.com/en-us/library/ms733130.aspx" rel="nofollow noreferrer">to learn</a> that although I set the service credentials to certificate, <a href="http://en.wikipedia.org/wiki/Web_Services_Description_Language" rel="nofollow noreferrer">WSDL</a> exposes </p>
  
  <pre><code>&lt;Identity&gt;
     &lt;Dns&gt;Foo&lt;/Dns&gt;
  &lt;/Identity&gt;
  </code></pre>
  
  <p>Again, on service I can set Identity to CertificateReference and hook it up to the same certificate, and then WSDL will expose identity as X509Certificate, but when I run the client that setting is ignored, and I end up with error message:</p>
  
  <blockquote>
    <p>System.ServiceModel.Security.SecurityNegotiationException:
    The X.509 certificate CN=xxx is not in
    the trusted people store. The X.509
    certificate CN=xxx chain building
    failed. The certificate that was used
    has a trust chain that can not be
    verified. Replace the certificate or
    change the certificateValidationMode.
    A certificate chain processed, but
    terminated in a root certificate which
    is not trusted by the trust provider.</p>
  </blockquote>
  
  <p>Is there a way to make client use that value from config and work without having to install a service certificate (nor its root) on client' machine?</p>
  
  <p><strong>[UPDATE]</strong>
  While setting certificateValidationMode to none will make the exception go away, it is unacceptable solution from security point of view.</p>
  
  <p>It makes the client merely acknowledge that it receive ''some'' certificate, without getting into details. This makes all range of man in the middle attacks possible. It still won't validate the information sent by (alleged) service against the certificate dumped in the config.</p>