title: X509Certificate Implementation best practices
body: <p>Firstly, Thanks to all those patient techies trying to help unknown people.</p>
  
  <p>Secondly, I have a wcf service which should be consumed by only several clients (10) known to our company. This wcf service has the x509certificate "CN=ABCD". Now it expects to receive a certificate in turn from clients to consume this service. So here are the design questions</p>
  
  <ol>
  <li>Should I create one certificate
  "CN=ABCD" , then right click on it
  and export as pfx files and
  distribute them to Clients?</li>
  <li>Some say to validate in code and
  some say to validate in config which
  is better?</li>
  <li>How should I know which client is
  calling as the certificate has same
  name for all if my company
  distributes it?</li>
  <li>what is the difference between .cer
  file and .pfx file?</li>
  <li>When passing the certificate to
  clients, will I be giving both .cer
  and .pfx files?</li>
  <li>How should I be revocing only one
  client if it expires?</li>
  <li>My comapny already has a certificate
      like *.fdfd.org . Can I use this as
      my X509Certificate instead of
      generating one?</li>
  </ol>
  
  <p>Many questions! <br/> But due to lot frustration, I wanted to have the opinion of developers out there because I couldn't get the right info. </p>