Wcf service throws exception: Could not establish trust relationship for the SSL/TLS secure channel with authority
<p>I know there are a lot of questions about this on stack overflow, but none of them are very recent and doesn't seem to address my problem in the fullest.</p>

<p>The situation is as follows:</p>

<p>We have a webservice running on IIS 6.2. The webservice is configured to accept only https traffic. The binding on the website is configured to use HTTPS, on all available Ip addresses, on the default port 443. the ssl certificate selected is a purchased, dedicated certificate.</p>

<p>The site is running in an dedicated app pool, with a dedicated user</p>

<p>The certificate chain is installed on the webserver, under the local machine in the following locations:</p>

<ul>
<li>Root ca - Trusted root certification authorities</li>
<li>organisation validation ca - intermediate certification authorities</li>
<li>pfx certificate - personal</li>
</ul>

<p>At the pfx certificate i granted the dedicated user read rights in the 'manage private key' option. while debugging i also granted the following accounts read access:</p>

<ul>
<li>networkService</li>
<li>iusr</li>
<li>iis_iusr</li>
</ul>

<p>i've added diagnostics to the webservice to create an svclog and also enabled logging for the instance of the webservice on IIS. Both logs seem to hold no information.</p>

<p>While troubleshooting the issue i tried to run a local test client. for this i needed to install the *.cer file in the personal store of the current user.</p>

<p>Mind you, we tried this on the webserver but also on the local machine. it both results in the following error message:</p>

<blockquote>
  <p>Could not establish trust relationship for the SSL/TLS secure channel with authority my.domain.com</p>
</blockquote>

<p>The config of the client:</p>

<pre><code>&lt;?xml version="1.0" encoding="utf-8" ?&gt;
&lt;configuration&gt;
    &lt;startup&gt;
        &lt;supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.5.2" /&gt;
    &lt;/startup&gt;
    &lt;system.serviceModel&gt;
        &lt;bindings&gt;
            &lt;basicHttpsBinding&gt;
                &lt;binding name="*MyServiceBinding*" sendTimeout="00:05:00" maxReceivedMessageSize="2147483647" maxBufferPoolSize="2147483647" &gt;
                    &lt;security mode="Transport"&gt;
                        &lt;transport clientCredentialType="Certificate" /&gt;
                    &lt;/security&gt;
                &lt;/binding&gt;
            &lt;/basicHttpsBinding&gt;
        &lt;/bindings&gt;
        &lt;behaviors&gt;
            &lt;endpointBehaviors&gt;
                &lt;behavior name="endpointBehavior"&gt;
                    &lt;clientCredentials &gt;
                        &lt;clientCertificate findValue="my.domain.com" storeLocation="CurrentUser" storeName="My" x509FindType="FindBySubjectName" /&gt;
                    &lt;/clientCredentials&gt;
                &lt;/behavior&gt;
            &lt;/endpointBehaviors&gt;
        &lt;/behaviors&gt;
        &lt;client&gt;
            &lt;endpoint address="https://my.domain.com/myService.svc"
                behaviorConfiguration="endpointBehavior" binding="basicHttpsBinding"
                bindingConfiguration="myServiceBinding" contract="MyService.IMyService"
                name="MyServiceEndpoint"&gt;
                &lt;identity&gt;
                    &lt;certificateReference findValue="my.domain.com" storeLocation="CurrentUser" storeName="My" x509FindType="FindBySubjectName" isChainIncluded="false" /&gt;
                &lt;/identity&gt;
            &lt;/endpoint&gt;
        &lt;/client&gt;
    &lt;/system.serviceModel&gt;
&lt;/configuration&gt;
</code></pre>

<p>The config of the webservice, i extracted only the relevant parts (as far as i know):</p>

<pre><code>&lt;bindings&gt;
    &lt;basicHttpsBinding&gt;
        &lt;binding name="basicHttpsEndpointBinding"&gt;
            &lt;security mode="Transport"&gt;
                &lt;transport clientCredentialType="Certificate"/&gt;
            &lt;/security&gt;
        &lt;/binding&gt;
    &lt;/basicHttpsBinding&gt;
&lt;/bindings&gt;

&lt;serviceBehaviors&gt;
    &lt;behavior name="httpsBehaviour"&gt;
        &lt;serviceMetadata httpsGetEnabled="true" httpGetEnabled="false" httpsGetBindingConfiguration="basicHttpsEndpointBinding"  /&gt;
        &lt;serviceDebug includeExceptionDetailInFaults="true" /&gt;
        &lt;serviceCredentials&gt;
            &lt;serviceCertificate findValue="my.domain.com" x509FindType="FindBySubjectName" storeLocation="LocalMachine" storeName="My"/&gt;
        &lt;/serviceCredentials&gt;
    &lt;/behavior&gt;
&lt;/serviceBehaviors&gt;

&lt;service behaviorConfiguration="httpsBehaviour" name="My.Service.MyService"&gt;
    &lt;endpoint binding="basicHttpsBinding" bindingConfiguration="basicHttpsEndpointBinding" name="MyServiceEndpoint" contract="My.Service.MyService.Interfaces.IMyInterFace"&gt;
        &lt;identity&gt;
            &lt;certificateReference findValue="my.domain.com" isChainIncluded="false" x509FindType="FindBySubjectName" storeLocation="LocalMachine" storeName="My"/&gt;
        &lt;/identity&gt;
    &lt;/endpoint&gt;
&lt;/service&gt;

&lt;serviceHostingEnvironment aspNetCompatibilityEnabled="true" multipleSiteBindingsEnabled="true"&gt;
    &lt;baseAddressPrefixFilters&gt;
        &lt;add prefix="https://my.domain.com/" /&gt;
    &lt;/baseAddressPrefixFilters&gt;
&lt;/serviceHostingEnvironment&gt;
</code></pre>

<p>If any extra information is required, then i am happy and willing to supply it. If anything is unclear please ask and i will try to clarify as much as i can.</p>

<p>Any help is greatly appreciated!</p>

<p>Edit: formatting, logging information</p>