title: WCF, Security and Certificates
body: <p>I have a client/server WCF application that needs some sort of user authentication against a database.  The application (both client and server together) is being developed to be sold to dozens of customers, for use on their intranets.  We're not too worried about encrypting most of the data moving across the wire, except of course during authentication.</p>
  
  <p>Thinking about WCF security, I keep coming back to the idea that we should be making use of x509 certificates. However, our customers will definitely not want to know about any of the details of having to apply for, purchase and install these certificates.</p>
  
  <p>I'd like to know first of all what the preferred method is of implementing username/password authentication in this scenario.  If it will require using certificates, must the customer apply for their own certs from a trusted CA, or can we as the software provider generate certificates for the customer to use?  </p>
  
  <p>Really I'm looking for a best practice, with the least friction to our customers.</p>
  
  <p>Thanks!</p>
  
  <p><strong>Edit:</strong>  I'm using NetTcpBinding, and my server is running as a Windows Service.</p>