title: In what certificate store should we put server's certificates
body: <p>Assume system <code>S</code> owns a certificate <code>C</code>. The following quote suggests that if <code>C</code> is to be used by <code>S's</code> service apps to authenticate themselves to clients, then <code>C</code> should be stored in <code>LCS</code>. But if <code>C</code> is to be used by <code>S's</code> client apps to authenticate themselves to a service, then <code>C</code> should be stored inside <code>CUS</code>:</p>
  
  <blockquote>
    <p>•  The local computer store (LCS).
    This contains the certificates
    accessed by machine processes, such as
    ASP.NET. Use this location to store
    certificates that authenticate the
    server to clients.  </p>
    
    <p>•  The current user store (CUS). Interactive
    applications typically place
    certificates here for the computer's
    current user. If you are creating a
    client application, this is where you
    typically place certificates that
    authenticate a user to a service.</p>
  </blockquote>
  
  <p>But next quote sort of negates the above, since it says if <code>S's</code> service is embedded in an application that runs under a user account, then certificate <code>C</code> should be stored inside <code>CUS</code></p>
  
  <blockquote>
    <p>Selecting where to store a certificate
    depends how and when the service or
    client runs. The following general
    rules apply:</p>
    
    <p>• If the service is a Windows service,
    a service running in "server" mode
    without any user interface under a
    Network service account, use the local
    machine store. Note that administrator
    privileges are required to install
    certificates into the local machine
    store.</p>
    
    <p>• If the service or client is embedded
    in an application that runs under a
    user account, then use the current
    user store.</p>
  </blockquote>
  
  <p>a) what is meant by <em>service being embedded within an application</em>? Is a WCF service running within Net. console application or within Asp.Net application considered to be embedded? </p>
  
  <p>b) And why if app ( which embeds WCF service ) runs under the user account ( even if this account has admin priviliges ), should certificate be located in <code>CUS</code>? Does that mean if it is located within <code>LCS</code>, then S ( aka client app trying to send this certificate to the server ) won't be able to locate certificate?</p>
  
  <p>thank you</p>