c# - WCF wsHttpBinding Client Certificate Authentication without using store in client -

i have wcf service registered such using wshttpbinding hosted in iis https binding valid , active certificate:

<?xml version="1.0"?> <configuration>   <system.webserver>     <security>       <access sslflags="ssl, sslnegotiatecert, sslrequirecert"/>       <authorization>         <add users="*" accesstype="allow" />       </authorization>     </security>   </system.webserver>   <system.web>     <authorization>       <allow users="*" />     </authorization>   </system.web>   <system.servicemodel>     <protocolmapping>       <add scheme="https" binding="wshttpbinding" />     </protocolmapping>     <bindings>       <wshttpbinding>         <binding name="mynamespace.webservice_transportsecurity">           <security mode="transport">             <transport clientcredentialtype="certificate" />           </security>         </binding>       </wshttpbinding>     </bindings>     <behaviors>       <servicebehaviors>         <behavior name="mynamespace.webservice_behaviour">           <servicemetadata httpgetenabled="false" httpsgetenabled="true" />           <servicedebug includeexceptiondetailinfaults="true" />           <servicecredentials>             <clientcertificate>               <authentication certificatevalidationmode="peerorchaintrust" revocationmode="nocheck" />             </clientcertificate>           </servicecredentials>         </behavior>       </servicebehaviors>     </behaviors>     <services>       <service name="mynamespace.webservice" behaviorconfiguration="mynamespace.webservice_behaviour">         <endpoint address=""                   binding="wshttpbinding"                   bindingconfiguration="mynamespace.webservice_transportsecurity"                   contract="mynamespace.imyservicecontract">         </endpoint>          <endpoint address="mex"                              binding="mexhttpsbinding"                   contract="imetadataexchange" />       </service>     </services>   </system.servicemodel> </configuration> 

i'm using .net 4 far can tell binding works ssl , client certificate authentication.

i've generated standard proxy using svcutil , trying set certificate (self signed in server) using it's base64 representation:

x509certificate2 certificate = new system.security.cryptography.x509certificates.x509certificate2(system.convert.frombase64string("thebase64ofthecertificate")); if (certificate == null) {     return null; } imyservicecontractclient client = new imyservicecontractclient(new system.servicemodel.wshttpbinding {     security = new system.servicemodel.wshttpsecurity     {         mode = system.servicemodel.securitymode.transport,         transport = new system.servicemodel.httptransportsecurity         {              clientcredentialtype = system.servicemodel.httpclientcredentialtype.certificate         }     } }, new system.servicemodel.endpointaddress(new system.uri("https://myserviceendpoint/webservice.svc"))); client.clientcredentials.clientcertificate.certificate = certificate; 

but not work if don't have certificate in local computer store, error:

i'm not expert in security, ssl or certificates, feasible?

all i'm trying achieve ensure service called code, , thought using self-signed client certificates validated in server do, if need in store adds unnecessary complexity whole thing!

---

update 1:

as suggested yacoub massad exporting certificate's base64 x509contenttype.pkcs12 yields exception:

an unhandled exception of type 'system.security.cryptography.cryptographicexception' occurred in mscorlib.dll  additional information: key not valid use in specified state. 

i'm loading certificate store with:

    x509certificate2 certificate = null;     x509store store = new x509store(storename.my, storelocation.localmachine);     try     {         store.open(openflags.readwrite);         var r = store.certificates.find(x509findtype.findbysubjectname, "licensingcert", false);         if (r.count > 0)             certificate = r[0];     }     catch     {         certificate = null;     }         {         if (store != null)             store.close();     }      if (certificate == null)     {         return null;     }     file.writealltext(@"c:\tmp\certs\exportlicensingcert.txt", convert.tobase64string(certificate.export(x509contenttype.pkcs12))); 

update 2:

made sure certificate had been imported mark exportable , did trick, must have skipped first time imported certificate. testing compiled code on computer has stopped doing error. thank yacoub massad pointing me in right direction :)

for certificate authentication work, client needs private key prove identity server. certificate alone not work.

make sure x509certificate2 setup wcf client use has corresponding private key.

you need pfx file contains certificate , private key , need import them x509certificate2 object via import method.