even when you do that you can get an execption like:

https://msdn2.microsoft.com/en-us/library/ms732362.aspx

WCF with x509

https://msdn2.microsoft.com/en-us/library/ms733137.aspx

Using client credentials

https://www.theserverside.net/tt/articles/showarticle.tss?id=SecuringWCFService

Delegation and Impersonation with WCF

https://msdn2.microsoft.com/en-us/library/ms730088.aspx

Specifying the Identity of a Service for Authentication 

https://msdn2.microsoft.com/en-us/library/ms733130.aspx

X509 - https://blogs.msdn.com/suwatch/default.aspx

client certificates - https://msdn2.microsoft.com/en-us/library/ms731899.aspx

wcf and x509 - https://blogs.msdn.com/suwatch/archive/2007/04/06/x509-and-wcxf-security.aspx

x509 between services : https://forums.microsoft.com/MSDN/ShowPost.aspx?PostID=164756&SiteID=1

WCF team blog - https://wcf.netfx3.com/blogs/wcf_team_bloggers/

IIS certificate authorization - https://staff.newtelligence.com/sergeys/WCFIISCertificatesAuthorization.aspx

MSMQ

https://msdn2.microsoft.com/en-us/library/ms731172.aspx

SetSPN - https://msdn2.microsoft.com/en-us/library/ms735117.aspx

Hosting Services

https://msdn2.microsoft.com/en-us/library/ms730158.aspx

Hosting and Consuming WCF Services

https://msdn2.microsoft.com/en-us/library/bb332338.aspx

working with certificate

https://msdn2.microsoft.com/en-us/library/ms731899.aspx

WCF performance

https://msdn2.microsoft.com/en-us/library/ms735098.aspx

https://msdn2.microsoft.com/en-us/library/bb310550.aspx

read more here:

https://blogs.msdn.com/shawnfa/archive/2007/05/09/the-silverlight-security-model.aspx

the common error is that developers installs the private key to a location that the program not allowed to access.

It can be difficult to find the location and name of the private key file associated with a specific X.509 certificate in the certificate store. The FindPrivateKey.exe tool facilitates this process.

X.509 certificates are installed by an Administrator or any user in the machine. However the certificate may be accessed by a service running under a different account (for example the ASPNET on Windows XP or the NETWORK SERVICE accounts on Windows Server 2003).

This account may not have access to the private key file because the certificate was not installed by it originally. The FindPrivateKey tool gives you the location of a given X.509 Certificate's private key file. You can add permissions or remove permissions to this file once you know the location of the particular X.509 certificates' private key file.

to get this tool go to https://msdn2.microsoft.com/en-us/library/aa717039.aspx
click on download sample and then browse to
%InstallDir%\WCF_Samples\TechnologySamples\Tools\FindPrivateKey\CS

Applications can be developed to take advantage of the most common type of policy setting, namely registry-based policy. For example, a programmer can create a component that includes “available” and “unavailable” functionality based on registry-based policy. Administrators then have a well-defined and simple process: They can use the GPMC to turn functionality on or off by for all affected users and computers. This type of policy is implemented using a built in registry client-side extension on every Group Policy client to process the data and manage the appropriate registry keys. Registry-based policy settings are stored in one of four secure Group Policy keys, which cannot be modified without administrative rights on the machine.

For more information, see the Implementing Registry-Based Group Policy article at https://www.microsoft.com/windows2000/techinfo/howitworks/management/rbppaper.asp.

you can effect the way that .NET 3.0 will be. you have three main spots where you can report a bug or even report a wish list.

.NET Framework 3.0

WCF: https://connect.Microsoft.com/wcf/Feedback

WF: https://connect.Microsoft.com/wf/Feedback

Visual studio:

https://connect.microsoft.com/visualstudio/feedback

those places are completely open to the public and all feedback items go straight into our the product studio DBs for servicing !! ]]> https://docs.microsoft.com/archive/blogs/appsec/fundamental-computer-investigation-guide-for-windows Thu, 08 Mar 2007 16:37:45 GMT https://blogs.msdn.microsoft.com/appsec/2007/03/08/fundamental-computer-investigation-guide-for-windows/ https://www.microsoft.com/technet/security/guidance/disasterrecovery/computer_investigation/default.mspx

can be downloaded here:

https://www.codeplex.com/entlib/Release/ProjectReleases.aspx?ReleaseId=2081

The example adds an X.509 binary security token in addition to a username security token. The token is passed in a WS-Security message header from the client to the service and part of the message is signed with the private key associated with the X.509 security token to prove the possession of the X.509 certificate to the receiver.

This is useful in the case when there is a requirement to have multiple claims associated with a message to authenticate or authorize the sender. The service implements a contract that defines a request-reply communication pattern.

 The sample demonstrates:

• How a client can pass additional security tokens to a service.

• How the server can access claims associated with additional security tokens.

• How the server's X.509 certificate is used to protect the symmetric key used for message encryption and signature.

 code can be downloaded here: https://msdn2.microsoft.com/en-us/library/ms751480.aspx