title: SOAP Security negotiation with service for target failed
body: <p>I'm calling an external web service from my .NET client. The hoster is using a self-signed certificate and they say I don't need to install any certificate to call their service.</p>
  
  <p>All my client and service configuration is in my app.config file, so I'm creating the client without any binding or end point address as parameters. I'm also using a service reference.</p>
  
  <pre><code>static void Main(string[] args)
      {
  
          ServiceReference.BgLinkServiceClient client = new ServiceReference.BgLinkServiceClient();
  
          ServiceReference.LogonRequest request = new ServiceReference.LogonRequest();
          ServiceReference.LogonResponse lg = new ServiceReference.LogonResponse();
  
          Console.WriteLine("Attempting to connect to the Service...");
          lg = client.Logon(request);
      }
  </code></pre>
  
  <p>My app.config:</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="utf-8"?&gt;
  &lt;configuration&gt;
  &lt;system.serviceModel&gt;
  &lt;behaviors&gt;
    &lt;endpointBehaviors&gt;
      &lt;behavior name="MessageTransportBehavior"&gt;
        &lt;clientCredentials&gt;
          &lt;serviceCertificate&gt;
            &lt;authentication certificateValidationMode="None" revocationMode="NoCheck"/&gt;
          &lt;/serviceCertificate&gt;
        &lt;/clientCredentials&gt;
      &lt;/behavior&gt;
    &lt;/endpointBehaviors&gt;
  &lt;/behaviors&gt;
  &lt;bindings&gt;
    &lt;customBinding&gt;
      &lt;binding name="CustomBinding_IBgLinkService"&gt;
        &lt;reliableSession /&gt;
        &lt;security defaultAlgorithmSuite="Basic256Sha256" authenticationMode="SecureConversation"
            requireDerivedKeys="true" includeTimestamp="true" messageSecurityVersion="WSSecurity11WSTrustFebruary2005WSSecureConversationFebruary2005WSSecurityPolicy11BasicSecurityProfile10"
            requireSignatureConfirmation="false" canRenewSecurityContextToken="true"&gt;
          &lt;secureConversationBootstrap defaultAlgorithmSuite="Basic256Sha256"
              authenticationMode="AnonymousForSslNegotiated" requireDerivedKeys="true"
              includeTimestamp="true" messageSecurityVersion="WSSecurity11WSTrustFebruary2005WSSecureConversationFebruary2005WSSecurityPolicy11BasicSecurityProfile10"
              requireSignatureConfirmation="true"&gt;
            &lt;localClientSettings detectReplays="true" /&gt;
            &lt;localServiceSettings detectReplays="true" /&gt;
          &lt;/secureConversationBootstrap&gt;
          &lt;localClientSettings detectReplays="true" /&gt;
          &lt;localServiceSettings detectReplays="true" /&gt;
        &lt;/security&gt;
        &lt;textMessageEncoding /&gt;
        &lt;httpsTransport /&gt;
      &lt;/binding&gt;
    &lt;/customBinding&gt;
  &lt;/bindings&gt;
  &lt;client&gt;
    &lt;endpoint 
        address="https://www.bt.bglinkws.bgonline.se/WebService/BgLinkService.svc"
        binding="customBinding" 
        bindingConfiguration="CustomBinding_IBgLinkService"
        contract="ServiceReference.IBgLinkService" 
        name="CustomBinding_IBgLinkService"&gt;
      &lt;identity&gt;
        &lt;dns value="www.bt.bglinkws.bgonline.se" /&gt;
      &lt;/identity&gt;
    &lt;/endpoint&gt;
  &lt;/client&gt;
  &lt;/system.serviceModel&gt;
  &lt;/configuration&gt;
  </code></pre>
  
  <p>I'm getting this error:
  SOAP security negotiation with '<a href="https://www.bt.bglinkws.bgonline.se/WebService/BgLinkService.svc" rel="nofollow">https://www.bt.bglinkws.bgonline.se/WebService/BgLinkService.svc</a>' for target '<a href="https://www.bt.bglinkws.bgonline.se/WebService/BgLinkService.svc" rel="nofollow">https://www.bt.bglinkws.bgonline.se/WebService/BgLinkService.svc</a>' failed.</p>
  
  <p>Inner Exception:
  {"The X.509 certificate CN=www.bt.bglinkws.bgonline.se, OU=ITS, O=Bankgirocentralen BGC AB, C=SE chain building failed. The certificate that was used has a trust chain that cannot be verified. Replace the certificate or change the certificateValidationMode. The revocation function was unable to check revocation because the revocation server was offline.\r\n"}</p>
  
  <p>Could use some help here, been struggling with this for a while.</p>