Click here to Skip to main content
13,405,390 members (57,844 online)
Click here to Skip to main content
Add your own
alternative version


180 bookmarked
Posted 23 May 2009

Nine simple steps to enable X.509 certificates on WCF

, 29 Aug 2012
Rate this:
Please Sign up or sign in to vote.
Nine simple steps to enable X.509 certificates on WCF.

Table of contents

Introduction and goal

In this article, we will discuss how we can enable certificates on a WCF service. WCF has two modes by which it transfers data: transport and message. This tutorial will concentrate on how we can enable certificates on the message mode of data transfer.

Nowadays I am distributing my 400 questions and answers ebook which covers major .NET related topics like WCF, WPF, WWF, AJAX, Core .NET, SQL Server, architecture, and a lot more. I am sure you will enjoy this ebook: I have also been recording videos on .NET technologies, you can catch all the action here.

Beginner WCF FAQs

In case you are fresh to WCF, please refer the below two WCF FAQ articles:

  • WCF FAQ Part 1: This is a 20 question FAQ for beginners which explains the basic concepts of WCF like End Points, contracts, and bindings. It also discusses the various hosting methodologies of WCF services. The article finally talks about bindings and one way operations in WCF.
  • WCF FAQ Part 2: This FAQ covers 10 questions which talks about concepts like duplex contracts, hosting WCF on different protocols, MSMQ bindings, transaction isolation levels, and two way communication. The article also talks about two queues: volatile and dead letter queue.

Step 1: Create client and server certificates

Create two certificates, one for the server and the other for the client, using makecert.exe. You can get makecert.exe from the “C:\Program Files\Microsoft Visual Studio 8\Common7\Tools\Bin” folder. You can go to the DOS prompt and run the below command snippet:

makecert.exe -sr CurrentUser -ss My -a sha1 -n CN=WCfServer -sky exchange -pe
makecert.exe -sr CurrentUser -ss My -a sha1 -n CN=WcfClient -sky exchange -pe

Below is a detailed explanation of the various attributes specified in makecert.exe.



Specifies the Registry location of the certificate store. The SubjectCertStoreLocation argument must be either of the following:

  • currentUser: Specifies the registry location HKEY_CURRENT_USER.
  • localMachine: Specifies the registry location HKEY_LOCAL_MACHINE.


Specifies the name of the certificate store where the generated certificate is saved.


Specifies the algorithm. Can be either MD5 or SHA1.


Specifies a name for the certificate. This name must conform to the X.500 standard. The simplest method is to use the "CN=MyName" format. If the /n switch is not specified, the default name of the certificate is "Joe's Software Emporium".


Specifies the key type. Can be either exchange or signature.


This makes the key exportable.

Note: Makecert.exe is a free tool provided by Microsoft which helps to create X.509 certificates that are signed by a system test root key or by another specified key. This is a test certificate and not a real one and should not be used for production purposes. For production, buy proper certificates from Thawte, Verisign, GeoTrust, etc.

Currently, we have specified that we want to create the client key with the WcfClient name and server key with WCFServer. The certificates should be created for the current user and should be exportable.

Once you run the command, you should see the Succeeded message as shown in the below figure. The below figure shows keys created for both the server and client.

Step 2: Copy the certificates in trusted people certificates

Go to Start -> Run and type MMC and press Enter. You will be popped with the MMC console. Click on File -> Add/remove snap-in. You will be popped up with an Add/Remove snap-in, click on the Add button, select Certificates, and select ‘My user account’.

You can see the certificates created for the client and server in the personal certificates folder. We need to copy those certificates in the Trusted people -> Certificates folder.

Step 3: Specify the certification path and mode in the WCF service web.config file

Now that we have created both the certificates, we need to refer these certificates in our WCF project. We have created two projects: one that has the WCF service and the other a web application which will consume the WCF service.

Let’s open the web.config file of the WCF service and enter two important things:

  • Where the certificate is stored, location, and how the WCF application should find it. This is defined using the serviceCertificate tag as shown in the below snippet.
  • certificationvalidationmode defines how the client certificates will be authenticated.
Certification validation modeDescription

Chain trust

In this situation, the client certificate is validated against the root certificate.

Peer trust

PeerTrust ensures that the public key portion of the certificate is in the Trusted People certificate folder on the client's computer


This is just an OR condition for both chain and peer.

The above two points are clubbed together and entered in the web.config file of the WCF service.

    <authentication certificateValidationMode="PeerTrust"/>
  <serviceCertificate findValue="WCfServer"



    x509FindType="FindBySubjectName" />

Step 4: Define bindings

Now that we have defined our certificates and authentication type, we need to define that the authentication values will be sent through a message using certificates. You can see we have defined the WsHttpBinding with a message attribute specifying that the WCF client needs to send a certificate for validation.

    <binding name="wsHttpEndpointBinding">
        <message clientCredentialType="Certificate" />

Step 5: Tie up the bindings with the endpoint

Once done, we need to tie up this binding with the end point. This is done by using the bindingConfiguration tag as shown in the below code snippet.

<endpoint address="" binding="wsHttpBinding" 

   bindingConfiguration="wsHttpEndpointBinding" contract="WCFServiceCertificate.IService1">

Step 6: Make your web application client for consuming the WCF service

That’s all we need from the WCF service perspective. Compile the WCF service and reference it in the ASP.NET web application using ‘Service reference’. Below is the code snippet where we have referenced the service and called the GetData function of the service.

using System;
using System.Collections.Generic;
using System.Linq;
using System.Web;
using System.Web.UI;
using System.Web.UI.WebControls;
using WebConsumer.ServiceReference1;
namespace WebConsumer
public partial class _Default : System.Web.UI.Page
    protected void Page_Load(object sender, EventArgs e)
        Service1Client obj = new Service1Client();

Now if you try to run the client, i.e., the web application, as it is, you should get an error as shown below. The error clearly indicates you can not use the WCF service until you provide the client certificate.

Step 7: Define the certificates in the WCF client

Let's start the process of defining certificates in the WCF client. The way we have defined the authentication certification mode and the path of the certificate, the same way we need to define it for the WCF client. You can see we have defined the authentication mode as peertrust and we have specified the client certificate name as WcfClient.

    <behavior name="CustomBehavior">
        <clientCertificate findValue="WcfClient" x509FindType="FindBySubjectName" 

          storeLocation="CurrentUser" storeName="My" />
          <authentication certificateValidationMode="PeerTrust"/>

Step 8: Tie up the behavior with the end point on the WCF client

We need to tie up the above defined behavior with the end point. You can see we have bound the behavior using the behaviorConfiguration property. We also need to specify that the DNS value will be WcfServer which is your server certificate name.

  <endpoint address="http://localhost:1387/Service1.svc" binding="wsHttpBinding"

      bindingConfiguration="WSHttpBinding_IService1" contract="ServiceReference1.IService1"

      name="WSHttpBinding_IService1" behaviorConfiguration="CustomBehavior">
      <dns value="WcfServer" />

Step 9: Enjoy your hard work

Once we are done, you can run the ASP.NET web app and you should see the below display.

Download code

You can download both the server and client code from here


This article, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)


About the Author

You may also be interested in...

Comments and Discussions

AnswerRe: The caller was not authenticated by the service.. Pin
Ranjan.D1-Oct-13 11:47
professionalRanjan.D1-Oct-13 11:47 
GeneralMy vote of 5 Pin
Edo Tzumer21-Jan-13 0:07
memberEdo Tzumer21-Jan-13 0:07 
QuestionFor Win 8 - IIS 8 and Win Store Client Pin
ursri17-Nov-12 3:24
memberursri17-Nov-12 3:24 
GeneralMy vote of 5 Pin
Kanasz Robert19-Sep-12 5:51
mvpKanasz Robert19-Sep-12 5:51 
GeneralMy vote of 5 Pin
Christian Amado29-Aug-12 12:03
memberChristian Amado29-Aug-12 12:03 
GeneralMy vote of 5 Pin
Rahman Masudur29-Aug-12 5:55
memberRahman Masudur29-Aug-12 5:55 
QuestionWrong Link Pin
Teri Hughes1-Aug-12 7:31
memberTeri Hughes1-Aug-12 7:31 
QuestionAlmost there Pin
Teri Hughes26-Jun-12 5:57
memberTeri Hughes26-Jun-12 5:57 
Your example worked fine until I tried to use it in IIS. I wrestled with the permissions and kept getting the keyset does not exist error that is plastered all over the internet.

Finally I stumbled on the solution that none of them tells you.

You have to install the private key you can see my description of how I managed to get past the error at:

I finally exported the self-signed key to a private key from the example and once I installed it into the Trusted People folder on the Local Computer I was able to give it the needed permissions and the error disappeared.

I tried all the examples on the Internet and they all missed the portion where you must install the private key. I granted permissions to all the certificates before finally getting to the real issue.

Good article but I hope my blog post shows the missing criteria for getting it to work on a IIS server.

Great work, Thanks Thumbs Up | :thumbsup:

Question{"The request for security token could not be satisfied because authentication failed."} Pin
sukesh.gudikandulla14-Jun-12 20:44
membersukesh.gudikandulla14-Jun-12 20:44 
AnswerRe: {"The request for security token could not be satisfied because authentication failed."} Pin
chrisndirangu28-Apr-14 12:17
memberchrisndirangu28-Apr-14 12:17 
QuestionUseful Article Pin
Alireza_13621-Jun-12 3:12
memberAlireza_13621-Jun-12 3:12 
QuestionError ! private key access rights Pin
Blue Clouds24-Nov-11 11:24
memberBlue Clouds24-Nov-11 11:24 
QuestionI can't get it to work on azure Pin
schnitty7-Sep-11 2:18
memberschnitty7-Sep-11 2:18 
BugGetting authentication [modified] Pin
Pradeep Babu Yadagani23-Aug-11 19:09
memberPradeep Babu Yadagani23-Aug-11 19:09 
GeneralOutstanding Pin
Member 469164210-Jun-11 0:17
memberMember 469164210-Jun-11 0:17 
GeneralNot Working in IIS Pin
aiwa nou13-Feb-11 19:01
memberaiwa nou13-Feb-11 19:01 
QuestionForum for article: 9 simple steps to enable X.509 certificates on WCF Pin
Member 20794887-Jun-10 3:28
memberMember 20794887-Jun-10 3:28 
GeneralInstalling certificate on client machine Pin
Member 426218215-Feb-10 2:48
memberMember 426218215-Feb-10 2:48 
GeneralRe: Installing certificate on client machine Pin
prabhatdeoria16-May-13 0:58
memberprabhatdeoria16-May-13 0:58 
GeneralNeed Help Pin
Milton_win7-Jan-10 19:58
memberMilton_win7-Jan-10 19:58 
Generalworking only with vswebserver not on the IIS. Pin
RamanaKumar.akula26-Oct-09 22:12
memberRamanaKumar.akula26-Oct-09 22:12 
GeneralRe: working only with vswebserver not on the IIS. Pin
hanuman05036-Jun-10 19:33
memberhanuman05036-Jun-10 19:33 
GeneralRe: working only with vswebserver not on the IIS. Pin
Himanshu Thawait29-Aug-13 12:16
memberHimanshu Thawait29-Aug-13 12:16 
GeneralThe caller was not authenticated by the service. Pin
amajid02686-Oct-09 17:23
memberamajid02686-Oct-09 17:23 
GeneralRe: The caller was not authenticated by the service. Pin
amajid02686-Oct-09 17:35
memberamajid02686-Oct-09 17:35 

General General    News News    Suggestion Suggestion    Question Question    Bug Bug    Answer Answer    Joke Joke    Praise Praise    Rant Rant    Admin Admin   

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.

Permalink | Advertise | Privacy | Terms of Use | Mobile
Web03 | 2.8.180221.1 | Last Updated 29 Aug 2012
Article Copyright 2009 by Shivprasad koirala
Everything else Copyright © CodeProject, 1999-2018
Layout: fixed | fluid