title: Mutual SSL authentication with WCF: no CertificateRequest and CertificateVerify in handshake phase
body: <p>I'm working on a WCF service that is to be consumed by a client that is not developed by me and also it's not .NET (possibly Java).</p>
  
  <p>In any case, the service should support mutual SSL authentication, where both the service and the client authenticate with certificates X.509 certs at the transport layer. The certificates have been exchanged between parties at a prior moment. </p>
  
  <p>My problem is that I cannot seem to get the right WCF configuration such that client certificate authentication works correctly. What I expect is that, as part of the TLS handshake, the server also includes a <code>Certificate Request</code>, as seen below:</p>
  
  <p><img src="https://i.stack.imgur.com/LgqHD.png" alt="enter image description here"></p>
  
  <p>Following this, the client should answer with a `Certificate Verify' among other things:</p>
  
  <p><img src="https://i.stack.imgur.com/MmEYq.png" alt="enter image description here"></p>
  
  <p>The (latest) service configuration is this one. I'm using a custom binding, with authentication mode set to <code>MutualSslNegotiated</code>. </p>
  
  <pre><code>&lt;bindings&gt;
    &lt;customBinding&gt;
      &lt;binding name="CarShareSecureHttpBindingCustom"&gt;
        &lt;textMessageEncoding messageVersion="Soap11" /&gt;
        &lt;security authenticationMode="MutualSslNegotiated"/&gt;
        &lt;httpsTransport requireClientCertificate="true" /&gt;
      &lt;/binding&gt;
    &lt;/customBinding&gt;
  &lt;/bindings&gt;
  
  ...
  
  &lt;serviceBehaviors&gt;
    &lt;behavior name="ServiceBehavior"&gt;
      &lt;serviceMetadata httpGetEnabled="false" httpsGetEnabled="true" /&gt;
      &lt;serviceDebug includeExceptionDetailInFaults="false" httpHelpPageEnabled="false" /&gt;
      &lt;serviceCredentials&gt;
        &lt;serviceCertificate findValue="..." storeLocation="LocalMachine" x509FindType="FindByIssuerName" storeName="My" /&gt;
        &lt;clientCertificate&gt;
          &lt;certificate findValue="..." storeName="My" storeLocation="LocalMachine" x509FindType="FindByIssuerName"/&gt;
        &lt;/clientCertificate&gt;
      &lt;/serviceCredentials&gt;
    &lt;/behavior&gt;
  &lt;/serviceBehaviors&gt;
  </code></pre>
  
  <p>The Server Hello part of the handshake looks like this for all service configurations I have tried, with no CertificateRequest. 
  <img src="https://i.stack.imgur.com/UPlPm.png" alt="enter image description here"></p>
  
  <p>Other things I should mention: </p>
  
  <ul>
  <li>The service is self hosted and listening on a non-default port (not 443). The server SSL certificate has been bound to this port.</li>
  <li>I have also tried a <code>basicHttpBinding</code> and a <code>wsHttpBidning</code> with security mode set to <code>Transport</code> and client authentication set to <code>Certificate</code>, with no results (same results actually). </li>
  </ul>
  
  <p>Any ideas would be appreciated. </p>