Accessing an IIS Hosted WCF Service from a Java Client using HTTPS and Username Authentication

1. Run makecert -n "CN=TestCA" -r -sv TestCA.pvk TestCA.cer, Enter "123" for the password (3 times).
2. Import TestCA.CER into Trusted Root Certification Authorities\Certificates of machine store with certificates MMC.
3. Use the TestCA certificate to sign a test server certificate by running the following BUT replace myFQDN with your FQDN: makecert -iv TestCA.pvk -n "CN=myFQDN" -ic TestCA.cer -pe -sky exchange -sv TestServer.pvk TestServer.cer, Enter "123" for the password (4 times)
4. Export PFX file from server private and public certificates: pvk2pfx -pvk TestServer.pvk -spc TestServer.cer -pfx TestServer.pfx -pi 123
5. Import TestServer.pfx into Personal\Certificates of machine store with certificates MMC. (Need to change file type filter to "Personal Information Exchange" when browsing for the file. Use "123" for the password again.
6. In IIS manager, click Default Web Site, click Bindings on the right hand side, click HTTPS, click Edit. Select the relevant certificate in the SSL certificate drop down and click Ok, then close.
7. Ensure certificate is correctly configured by browsing to https://FQDN in Internet Explorer and ensuring the IIS welcome page is displayed without any certificate warnings.

1. keytool -genkey -alias mydomain -keyalg RSA -keystore keystore.jks -keysize 2048
2. Enter "123456" for the password (twice).
3. Keep pushing Enter to accept the defaults until it asks if it's correct, then type "yes" and push enter.
4. Enter "123456" for the password (twice).
5. keytool -import -trustcacerts -alias root -file D:\Documents\Work\CertificateStuff\TestCA.cer -keystore keystore.jks [Edit path to TestCA.cer as needed].
6. Enter "123456" for the password.
7. Type "yes" and push enter.
8. keytool -import -trustcacerts -alias myFQDN -file D:\Documents\Work\CertificateStuff\TestServer.cer -keystore keystore.jks [1. Replace myFQDN with you FQDN. 2. Edit path to TestServer.cer as needed.]
9. Enter "123456" for the password.
10. Move keystore.jks out of JDK bin folder to a more convenient location.

<configuration>

 <system.web>
  <compilation debug="true" targetframework="4.0" />
  <membership defaultprovider="TestMembershipProvider">
   <providers>
    <add name="TestMembershipProvider" type="WCFInteropService.TestMembershipProvider" />
   </providers>
  </membership>
 </system.web>
 
 <system.servicemodel>

  <bindings>
   <basichttpbinding>
    <binding name="BasicServiceBinding">    
     <security mode="TransportWithMessageCredential">
      <transport clientcredentialtype="None" />
      <message clientcredentialtype="UserName" />
     </security>     
    </binding>
   </basichttpbinding>   
  </bindings>
  
  <behaviors>
   <servicebehaviors>
    <behavior name="ServiceBehavior">
     <servicemetadata httpgetenabled="true" />
     <servicedebug includeexceptiondetailinfaults="false" />
     <servicecredentials>
      <usernameauthentication usernamepasswordvalidationmode="MembershipProvider">
       membershipProviderName="TestMembershipProvider" />
     </usernameauthentication></servicecredentials>
    </behavior>
   </servicebehaviors>
  </behaviors>

  <services>
   <service behaviorconfiguration="ServiceBehavior" name="TestWcfBasicHttpService.Service">
    <endpoint address="" binding="basicHttpBinding" bindingconfiguration="BasicServiceBinding" contract="TestWcfBasicHttpService.IService">
    </endpoint>
    <endpoint address="mex" binding="mexHttpBinding" contract="IMetadataExchange" />
   </service>
  </services>
  
 </system.servicemodel> 
</configuration>

<configuration>
 <system.web>
  <compilation debug="false" targetframework="4.0" />
  <membership defaultprovider="TestMembershipProvider">
   <providers>
    <add name="TestMembershipProvider" type="WCFInteropService.TestMembershipProvider" />
   </providers>
  </membership>
 </system.web>
 <system.servicemodel>
  <services>
   <service name="Service" behaviorconfiguration="ServiceBehavior">
    <!-- Service Endpoints -->
    <endpoint address="" bindingconfiguration="interopBinding" binding="metroBinding" contract="IService">
     <!-- 
       Upon deployment, the following identity element should be removed or replaced to reflect the 
       identity under which the deployed service runs.  If removed, WCF will infer an appropriate identity 
       automatically.
     -->
     <identity>
      <dns value="localhost" />
     </identity>
    </endpoint>
    <endpoint address="mex" binding="mexHttpBinding" contract="IMetadataExchange" />
   </service>
  </services>
  <behaviors>
   <servicebehaviors>
    <behavior name="ServiceBehavior">
     <!-- To avoid disclosing metadata information, set the value below to false and remove the metadata endpoint above before deployment -->
     <servicemetadata httpgetenabled="true" />
     <!-- To receive exception details in faults for debugging purposes, set the value below to true.  Set to false before deployment to avoid disclosing exception information -->
     <servicedebug includeexceptiondetailinfaults="false" />
     <!-- To configure the service certificate -->
     <servicecredentials>
      <servicecertificate storelocation="LocalMachine" storename="My" x509findtype="FindBySubjectDistinguishedName" findvalue="CN=myFQDN" />
      <usernameauthentication usernamepasswordvalidationmode="MembershipProvider" membershipprovidername="TestMembershipProvider" />
     </servicecredentials>
    </behavior>
   </servicebehaviors>
  </behaviors>
  <bindings>
   <metrobinding>
    <binding name="interopBinding" messageencoding="Text">
     <security mode="UserNameOverCertificate" establishsecuritycontext="false" algorithmsuite="Default" />
    </binding>
   </metrobinding>
  </bindings>
  <extensions>
   <bindingextensions>
    <add name="metroBinding" type="Microsoft.ServiceModel.Interop.Metro.Configuration.MetroBindingCollectionElement, Microsoft.ServiceModel.Interop, Version=1.0.0.0, Culture=neutral, PublicKeyToken=4fc38efee625237e" />
   </bindingextensions>
  </extensions>
 </system.servicemodel>
 <system.webserver>
  <modules runallmanagedmodulesforallrequests="true" />
 </system.webserver>
</configuration>