title: WCF transport security, wsHttpBinding, message security in load balancer
body: <p>I have a WCF service that uses message security over HTTPS using wsHttpBinding behind load balancer. When connects to the service on web browser via https, it works. However, Windowns forms client failed, using certificate over https,</p>
  
  <p>Update </p>
  
  <p>The request url is https, but after the exception saying http, below is exception tracing on server side:</p>
  
  <p>For example: the request url is </p>
  
  <p><strong>https:</strong>//www.server.com/wcf.svc'.</p>
  
  <p>But it becomes</p>
  
  <p><strong>http:</strong>//www.server.com:<strong>81</strong>/wcf.svc' on the server side. Is it the load balancer causing it.</p>
  
  <p>System.ServiceModel.EndpointNotFoundException, System.ServiceModel, Version=3.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</p>
  
  <p>There was no channel actively listening at 'http://www.server.com:81/wcf.svc'. This is often caused by an incorrect address URI. Ensure that the address to which the message is sent matches an address on which a service is listening.</p>
  
  <p>Below is the WCF service config:</p>
  
  <pre><code>&lt;system.serviceModel&gt;
      &lt;diagnostics&gt;
        &lt;messageLogging logEntireMessage="true" logMalformedMessages="true"
                logMessagesAtServiceLevel="true" logMessagesAtTransportLevel="false" /&gt;
      &lt;/diagnostics&gt;
      &lt;services&gt;
        &lt;service behaviorConfiguration="verServiceBehaviour" name="ver.Service"&gt;
  
          &lt;endpoint address="ver" binding="wsHttpBinding" bindingConfiguration="wshttpbindingcfg"             
                     contract="ver.Iver"  behaviorConfiguration ="verEndpointBehaviour"&gt;  
          &lt;/endpoint&gt;
  
          &lt;endpoint address="mex" binding="mexHttpBinding" bindingConfiguration="mexhttpbinding" contract="IMetadataExchange" /&gt;
          &lt;host&gt;
            &lt;baseAddresses&gt;
              &lt;add baseAddress="https://www.server.com/" /&gt;
            &lt;/baseAddresses&gt;
          &lt;/host&gt;
        &lt;/service&gt;   
  
      &lt;/services&gt;
      &lt;bindings&gt;
        &lt;mexHttpBinding&gt;
          &lt;binding name="mexhttpbinding" /&gt;
        &lt;/mexHttpBinding&gt;
        &lt;wsHttpBinding&gt;
          &lt;binding name="wshttpbindingcfg" maxReceivedMessageSize="2000000000" sendTimeout="00:10:00"&gt;
            &lt;readerQuotas maxStringContentLength="2000000000"/&gt;
  
            &lt;reliableSession ordered="true" enabled="false" /&gt;
  
              &lt;security mode="None"&gt;
                          &lt;transport clientCredentialType="None" proxyCredentialType="None"
                              realm="" /&gt;
                          &lt;message clientCredentialType="Certificate" negotiateServiceCredential="true"
                              algorithmSuite="Default" establishSecurityContext="false" /&gt;
                      &lt;/security&gt;
  
          &lt;/binding&gt;
        &lt;/wsHttpBinding&gt;
      &lt;/bindings&gt;
      &lt;behaviors&gt;
        &lt;endpointBehaviors&gt;
          &lt;behavior name="verEndpointBehaviour"&gt;
            &lt;instanceContextBehavior/&gt;
            &lt;verInspectorBehavior/&gt;
          &lt;/behavior&gt;
        &lt;/endpointBehaviors&gt;
        &lt;serviceBehaviors&gt;
          &lt;behavior name="verServiceBehaviour"&gt;
            &lt;dataContractSerializer maxItemsInObjectGraph="100000000"/&gt;
            &lt;serviceMetadata httpGetEnabled="true" /&gt;
            &lt;serviceDebug includeExceptionDetailInFaults="true" /&gt;
  
            &lt;serviceCredentials&gt;
              &lt;clientCertificate&gt;
                &lt;authentication certificateValidationMode="PeerOrChainTrust" revocationMode="NoCheck" trustedStoreLocation="LocalMachine" mapClientCertificateToWindowsAccount="false"/&gt;
              &lt;/clientCertificate&gt;
  
                  &lt;serviceCertificate
                 x509FindType="FindByThumbprint"
                 findValue="xxxx"
                 storeLocation="LocalMachine"
                 storeName="My"/&gt;
  
            &lt;/serviceCredentials&gt;
  
          &lt;/behavior&gt;
  
  
        &lt;/serviceBehaviors&gt;
      &lt;/behaviors&gt;
  
    &lt;/system.serviceModel&gt;
  </code></pre>
  
  <p>Below is client config:</p>
  
  <pre><code>&lt;configuration&gt;
      &lt;appSettings&gt;
          &lt;add key="CertificateSubjectName" value="subjectName"/&gt;
      &lt;/appSettings&gt;
      &lt;system.serviceModel&gt;
          &lt;bindings&gt;
              &lt;wsHttpBinding&gt;
                  &lt;binding name="WSHttpBinding_ver.IverHTTPS" closeTimeout="00:01:00"
                      openTimeout="00:01:00" receiveTimeout="00:10:00" sendTimeout="00:01:00"
                      bypassProxyOnLocal="false" transactionFlow="false" hostNameComparisonMode="StrongWildcard"
                      maxBufferPoolSize="524288" maxReceivedMessageSize="65536"
                      messageEncoding="Text" textEncoding="utf-8" useDefaultWebProxy="true"
                      allowCookies="false"&gt;
                      &lt;readerQuotas maxDepth="32" maxStringContentLength="8192" maxArrayLength="16384"
                          maxBytesPerRead="4096" maxNameTableCharCount="16384" /&gt;
                      &lt;reliableSession ordered="true" inactivityTimeout="00:10:00"
                          enabled="false" /&gt;
  
                      &lt;security mode="TransportWithMessageCredential"&gt;
                          &lt;transport clientCredentialType="None" proxyCredentialType="None"
                              realm="" /&gt;
                          &lt;message clientCredentialType="Certificate" negotiateServiceCredential="true"
                              algorithmSuite="Default" establishSecurityContext="false" /&gt;
  
                      &lt;/security&gt;
                  &lt;/binding&gt;
  
              &lt;/wsHttpBinding&gt;
          &lt;/bindings&gt;
          &lt;client&gt;
              &lt;endpoint address="https://www.server.com/wcf.svc" 
                binding="wsHttpBinding" bindingConfiguration="WSHttpBinding_ver.IverHTTPS"
                contract="ServiceReference.verIver" name="verEndPoint" /&gt;
  
  
          &lt;/client&gt;
      &lt;/system.serviceModel&gt;
  &lt;/configuration&gt;
  </code></pre>
  
  <p>below is code in client using certificate:</p>
  
  <pre><code>var proxyClient = new ServiceReference.VerIVerClient("verEndPoint");
  
  proxyClient.ClientCredentials.ClientCertificate.SetCertificate(
      System.Security.Cryptography.X509Certificates.StoreLocation.CurrentUser,
      System.Security.Cryptography.X509Certificates.StoreName.My,    
      System.Security.Cryptography.X509Certificates.X509FindType.FindBySubjectName,
      subjectName");                   
  
  proxyClient.CallService()
  </code></pre>
  
  <p>Below is exception received at client side:</p>
  
  <pre><code>System.ServiceModel.EndpointNotFoundException was unhandled
    Message=There was no endpoint listening at https://ver20.server.com/wcf.svc that could accept the message. This is often caused by an incorrect address or SOAP action. See InnerException, if present, for more details.
    Source=mscorlib
    StackTrace:
      Server stack trace: 
         at System.ServiceModel.Channels.HttpChannelUtilities.ProcessGetResponseWebException(WebException webException, HttpWebRequest request, HttpAbortReason abortReason)
         at System.ServiceModel.Channels.HttpChannelFactory.HttpRequestChannel.HttpChannelRequest.WaitForReply(TimeSpan timeout)
         at System.ServiceModel.Channels.RequestChannel.Request(Message message, TimeSpan timeout)
         at System.ServiceModel.Channels.SecurityChannelFactory`1.SecurityRequestChannel.Request(Message message, TimeSpan timeout)
         at System.ServiceModel.Dispatcher.RequestChannelBinder.Request(Message message, TimeSpan timeout)
         at System.ServiceModel.Channels.ServiceChannel.Call(String action, Boolean oneway, ProxyOperationRuntime operation, Object[] ins, Object[] outs, TimeSpan timeout)
         at System.ServiceModel.Channels.ServiceChannelProxy.InvokeService(IMethodCallMessage methodCall, ProxyOperationRuntime operation)
         at System.ServiceModel.Channels.ServiceChannelProxy.Invoke(IMessage message)
      Exception rethrown at [0]: 
         at System.Runtime.Remoting.Proxies.RealProxy.HandleReturnMessage(IMessage reqMsg, IMessage retMsg)
         at System.Runtime.Remoting.Proxies.RealProxy.PrivateInvoke(MessageData&amp; msgData, Int32 type)
         at verClient.ServiceReference.verIver.GetClaimver(GetClaimverClaimApplication ClaimApplication)
         at verClient.ServiceReference.verIverClient.GetClaimver(GetClaimverClaimApplication ClaimApplication) in D:\Projects\ver\verClient\Service References\ServiceReference\Reference.cs:line 11330
         at verClient.verForm.PostXmlTover(GetClaimverClaimApplication ClaimApplication) in D:\Projects\ver\verClient\verForm.cs:line 1408
         at verClient.verForm.PostButton_Click(Object sender, EventArgs e) in D:\Projects\ver\verClient\verForm.cs:line 34
         at System.Windows.Forms.Control.OnClick(EventArgs e)
         at System.Windows.Forms.Button.OnClick(EventArgs e)
         at System.Windows.Forms.Button.OnMouseUp(MouseEventArgs mevent)
         at System.Windows.Forms.Control.WmMouseUp(Message&amp; m, MouseButtons button, Int32 clicks)
         at System.Windows.Forms.Control.WndProc(Message&amp; m)
         at System.Windows.Forms.ButtonBase.WndProc(Message&amp; m)
         at System.Windows.Forms.Button.WndProc(Message&amp; m)
         at System.Windows.Forms.Control.ControlNativeWindow.OnMessage(Message&amp; m)
         at System.Windows.Forms.Control.ControlNativeWindow.WndProc(Message&amp; m)
         at System.Windows.Forms.NativeWindow.DebuggableCallback(IntPtr hWnd, Int32 msg, IntPtr wparam, IntPtr lparam)
         at System.Windows.Forms.UnsafeNativeMethods.DispatchMessageW(MSG&amp; msg)
         at System.Windows.Forms.Application.ComponentManager.System.Windows.Forms.UnsafeNativeMethods.IMsoComponentManager.FPushMessageLoop(IntPtr dwComponentID, Int32 reason, Int32 pvLoopData)
         at System.Windows.Forms.Application.ThreadContext.RunMessageLoopInner(Int32 reason, ApplicationContext context)
         at System.Windows.Forms.Application.ThreadContext.RunMessageLoop(Int32 reason, ApplicationContext context)
         at System.Windows.Forms.Application.Run(Form mainForm)
         at verClient.Program.Main() in D:\Projects\ver\verClient\Program.cs:line 18
         at System.AppDomain._nExecuteAssembly(RuntimeAssembly assembly, String[] args)
         at System.AppDomain.ExecuteAssembly(String assemblyFile, Evidence assemblySecurity, String[] args)
         at Microsoft.VisualStudio.HostingProcess.HostProc.RunUsersAssembly()
         at System.Threading.ThreadHelper.ThreadStart_Context(Object state)
         at System.Threading.ExecutionContext.Run(ExecutionContext executionContext, ContextCallback callback, Object state, Boolean ignoreSyncCtx)
         at System.Threading.ExecutionContext.Run(ExecutionContext executionContext, ContextCallback callback, Object state)
         at System.Threading.ThreadHelper.ThreadStart()
    InnerException: System.Net.WebException
         Message=The remote server returned an error: (404) Not Found.
         Source=System
         StackTrace:
              at System.Net.HttpWebRequest.GetResponse()
              at System.ServiceModel.Channels.HttpChannelFactory.HttpRequestChannel.HttpChannelRequest.WaitForReply(TimeSpan timeout)
         InnerException: 
  </code></pre>