Code

  客户端

Code

我这样的配置虽然客户端在不提供证书的情况下仍然能够看到服务的元数据终结点（主要是因为ＩＩＳ没有配置为要求客户端证书），但是在调用服务时
如果没有证书，就会抱错，目的基本达到。
最后我想说一下，书上讲authentication certificateValidationMode配置为PreeTrust比较好，只要在信任的人的列表里就可以通过验证，可是经过我的试验
似乎不是这样，在我的客户端和服务中，authentication certificateValidationMode值配置为PreeTrust或ChainTrust没有什么区别，客户端都需要将证明
自己的证书找出来，提供给服务，不然就要抱错。后来我在MSDN找到一段文字是这样解释的：
 
    <endpointBehaviors>
      <behavior name="ClientCertificateBehavior">
        <!--
      The clientCredentials behavior allows you to define a certificate to present to a service.
      A certificate is used by a client to authenticate itself to the service and provide message integrity.
      This configuration references the "client.com" certificate installed during the setup instructions.
      -->
        <clientCredentials>
          <clientCertificate findValue="client.com" storeLocation="CurrentUser" storeName="My" x509FindType="FindBySubjectName" />
          <serviceCertificate>
            <!--
          Setting the certificateValidationMode to PeerOrChainTrust means that if the certificate
          is in the user's Trusted People store, then it is trusted without performing a
          validation of the certificate's issuer chain. This setting is used here for convenience so that the
          sample can be run without having certificates issued by a certificate authority (CA).
          This setting is less secure than the default, ChainTrust. The security implications of this
          setting should be carefully considered before using PeerOrChainTrust in production code.
          -->
            <authentication certificateValidationMode="PeerOrChainTrust" />
          </serviceCertificate>
        </clientCredentials>
      </behavior>
    </endpointBehaviors>

看来有时候还是要看看英文，才能学好ＷＣＦ。。。。。

更新：根据jillzhang的说法，并加以验证，确实只要将证书放到LocalMachine中，不需要WinHttpCertCfg.exe 配置，WCF就能找到，不会抱无法找到证书错误，谢谢jillzhang。