BasicHttpBinding with Certificate authentication - error "forbidden"?

Question

I'm trying go get WCF server and client mutually authenticate each other using SSL certificates on transport level using BasicHttpBinding. Here's how the server is getting created:

var soapBinding = new BasicHttpBinding() { Namespace = "http://test.com" };
soapBinding.Security.Mode = BasicHttpSecurityMode.Transport;
soapBinding.Security.Transport.ClientCredentialType =
    HttpClientCredentialType.Certificate;
var sh = new ServiceHost(typeof(Service1), uri);
sh.AddServiceEndpoint(typeof(IService1), soapBinding, "");
sh.Credentials.ServiceCertificate.SetCertificate(
    StoreLocation.LocalMachine, StoreName.My, 
    X509FindType.FindBySubjectName, "localhost");
sh.Open();

Here's the client:

var binding = new BasicHttpBinding();
binding.Security.Mode = BasicHttpSecurityMode.Transport;
var service = new ServiceReference2.Service1Client(binding,
    new EndpointAddress("https://localhost:801/Service1"));

service.ClientCredentials.ClientCertificate.SetCertificate(
    StoreLocation.LocalMachine, StoreName.My, 
    X509FindType.FindBySubjectName, "localhost");

service.ClientCredentials.ServiceCertificate.Authentication.
    CertificateValidationMode =
        System.ServiceModel.Security.X509CertificateValidationMode.PeerTrust;

service.HelloWorld();

Certificate for localhost is in Personal, Trusted Root and Trusted 3rd Party containers. Internet Explorer can connect to host and see WSDL. Also, SSL calls work fine with ClientCredentialType = HttpClientCredentialType.None

HelloWorld() fails with:

System.ServiceModel.Security.MessageSecurityException occurred<br/>
  Message="The HTTP request was forbidden with client authentication
  scheme 'Anonymous'."

which is a rethrown exception from: "The remote server returned an error: (403) Forbidden."

how does one go around figuring out wtf is going on?

Answer 1

Try adding this in the client just after setting Security.Mode:

binding.Security.Transport.ClientCredentialType = HttpClientCredentialType.Certificate;