WCF "A call to SSPI failed, see inner exception"
<p>We have an existing system that uses WCF and was working fine until yesterday, when suddenly it stopped working on both my machine and another developer machine.</p>

<p>I've setup system diagnostics in the client config to write a trace file and we see the following exception:</p>

<pre><code>Throwing an exception 

**Basic Information**

Activity Name           Receive bytes on connection 'net.tcp://localhost:8004/'.
Time                    2016-01-06 13:38:45.3958
Level                   Error
Source                  System.ServiceModel
Process                 NServiceBus.Host
Thread                  219
Computer                RL-ZORO-LPT
Trace Identifier/Code   http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.ThrowingException.aspx


**Exception**

System.ServiceModel.Security.SecurityNegotiationException, System.ServiceModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
    System.Security.Authentication.AuthenticationException, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
         System.ComponentModel.Win32Exception, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089

Exception Type: System.ServiceModel.Security.SecurityNegotiationException, System.ServiceModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089

Message: A call to SSPI failed, see inner exception.

Stack Trace:  System.ServiceModel.Channels.StreamSecurityUpgradeAcceptorAsyncResult.CompleteAuthenticateAsServer(IAsyncResult result)
              System.ServiceModel.Channels.StreamSecurityUpgradeAcceptorAsyncResult.OnAuthenticateAsServer(IAsyncResult result)
              System.Runtime.Fx.AsyncThunk.UnhandledExceptionFrame(IAsyncResult result)
              System.Net.LazyAsyncResult.Complete(IntPtr userToken)
              System.Net.LazyAsyncResult.ProtectedInvokeCallback(Object result, IntPtr userToken)
              System.Net.Security.SslState.FinishHandshake(Exception e, AsyncProtocolRequest asyncRequest)
              System.Net.Security.SslState.ReadFrameCallback(AsyncProtocolRequest asyncRequest)
              System.Net.AsyncProtocolRequest.CompleteRequest(Int32 result)
              System.Net.FixedSizeReader.CheckCompletionBeforeNextRead(Int32 bytes)
              System.Net.FixedSizeReader.ReadCallback(IAsyncResult transportResult)
              System.Runtime.AsyncResult.Complete(Boolean completedSynchronously)
              System.ServiceModel.Channels.ConnectionStream.IOAsyncResult.OnAsyncIOComplete(Object state)
              System.ServiceModel.Channels.TracingConnection.TracingConnectionState.ExecuteCallback()
              System.Net.Sockets.SocketAsyncEventArgs.OnCompleted(SocketAsyncEventArgs e)
              System.Net.Sockets.SocketAsyncEventArgs.FinishOperationSuccess(SocketError socketError, Int32 bytesTransferred, SocketFlags flags)
              System.Net.Sockets.SocketAsyncEventArgs.CompletionPortCallback(UInt32 errorCode, UInt32 numBytes, NativeOverlapped* nativeOverlapped)
              System.Threading._IOCompletionCallback.PerformIOCompletionCallback(UInt32 errorCode, UInt32 numBytes, NativeOverlapped* pOVERLAP)
</code></pre>

<p>Our <strong>server</strong> configuration looks like this:</p>

<pre><code>&lt;system.serviceModel&gt;
    &lt;services&gt;
      &lt;service name="ServerImpl.RACServiceImpl.RACService" behaviorConfiguration="BILLService.ServiceBehavior"&gt;
        &lt;host&gt;
          &lt;baseAddresses&gt;
            &lt;add baseAddress="net.Tcp://localhost:8004" /&gt;
            &lt;add baseAddress="http://localhost:8006" /&gt;
          &lt;/baseAddresses&gt;
        &lt;/host&gt;
        &lt;!-- Service Endpoints --&gt;
        &lt;endpoint address="BILLService" binding="netTcpBinding" bindingConfiguration="netTcpBindingConf" contract="ServerImpl.Rsp.ServiceInterfaces.IRACService"&gt;
          &lt;identity&gt;
            &lt;dns value="RACServer" /&gt;
          &lt;/identity&gt;
        &lt;/endpoint&gt;
        &lt;endpoint address="mex" binding="mexHttpBinding" contract="IMetadataExchange" /&gt;
      &lt;/service&gt;
    &lt;/services&gt;
    &lt;client&gt;
      &lt;endpoint address="net.Tcp://localhost:8001/RMACService" behaviorConfiguration="ClientBehavior" binding="netTcpBinding" bindingConfiguration="netTcpBindingConf" contract="ServerImpl.Rsp.ServiceInterfaces.IRACService" name="IRACService"&gt;
        &lt;identity&gt;
          &lt;dns value="RACServer" /&gt;
        &lt;/identity&gt;
      &lt;/endpoint&gt;
    &lt;/client&gt;
    &lt;behaviors&gt;
      &lt;serviceBehaviors&gt;
        &lt;behavior name="BILLService.ServiceBehavior"&gt;
          &lt;!-- To avoid disclosing metadata information, set the value below to false and remove the metadata endpoint above before deployment --&gt;
          &lt;serviceMetadata httpGetEnabled="false" /&gt;
          &lt;!-- To receive exception details in faults for debugging purposes, set the value below to true.  Set to false before deployment to avoid disclosing exception information --&gt;
          &lt;serviceDebug includeExceptionDetailInFaults="true" /&gt;
          &lt;serviceCredentials&gt;
            &lt;serviceCertificate findValue="RACServer" storeLocation="LocalMachine" storeName="My" x509FindType="FindBySubjectName" /&gt;
            &lt;clientCertificate&gt;
              &lt;certificate findValue="RACClient" storeLocation="LocalMachine" storeName="My" x509FindType="FindBySubjectName" /&gt;
              &lt;authentication certificateValidationMode="PeerOrChainTrust" revocationMode="NoCheck" /&gt;
            &lt;/clientCertificate&gt;
          &lt;/serviceCredentials&gt;
          &lt;serviceThrottling maxConcurrentCalls="40" maxConcurrentInstances="40" maxConcurrentSessions="40" /&gt;
          &lt;dataContractSerializer maxItemsInObjectGraph="2147483647" /&gt;
        &lt;/behavior&gt;
      &lt;/serviceBehaviors&gt;
      &lt;endpointBehaviors&gt;
        &lt;behavior name="ClientBehavior"&gt;
          &lt;clientCredentials&gt;
            &lt;clientCertificate findValue="RACClient" storeLocation="LocalMachine" storeName="My" x509FindType="FindBySubjectName" /&gt;
            &lt;serviceCertificate&gt;
              &lt;defaultCertificate findValue="RACServer" storeLocation="LocalMachine" storeName="My" x509FindType="FindBySubjectName" /&gt;
              &lt;authentication certificateValidationMode="PeerOrChainTrust" revocationMode="NoCheck" /&gt;
            &lt;/serviceCertificate&gt;
          &lt;/clientCredentials&gt;
        &lt;/behavior&gt;
      &lt;/endpointBehaviors&gt;
    &lt;/behaviors&gt;
    &lt;bindings&gt;
      &lt;netTcpBinding&gt;
        &lt;binding name="netTcpBindingConf" closeTimeout="00:11:00" receiveTimeout="00:10:00" sendTimeout="00:10:00" transactionFlow="false" hostNameComparisonMode="StrongWildcard" maxReceivedMessageSize="2147483647" maxBufferPoolSize="2147483647" maxBufferSize="2147483647" maxConnections="100" openTimeout="00:20:00"&gt;
          &lt;readerQuotas maxDepth="2147483647" maxStringContentLength="2147483647" maxArrayLength="2147483647" maxBytesPerRead="2147483647" maxNameTableCharCount="2147483647" /&gt;
          &lt;reliableSession ordered="true" inactivityTimeout="00:15:00" /&gt;
          &lt;security mode="TransportWithMessageCredential"&gt;
            &lt;message clientCredentialType="Certificate" algorithmSuite="Default" /&gt;
            &lt;transport clientCredentialType="Windows" protectionLevel="EncryptAndSign" /&gt;
          &lt;/security&gt;
        &lt;/binding&gt;
      &lt;/netTcpBinding&gt;
    &lt;/bindings&gt;
&lt;/system.serviceModel&gt;
</code></pre>

<p>This is our <strong>client</strong> configuration:</p>

<pre><code>&lt;system.serviceModel&gt;
    &lt;bindings&gt;
      &lt;netTcpBinding&gt;
        &lt;binding name="netTcpBinding_RACService" closeTimeout="00:10:00" openTimeout="00:40:00" receiveTimeout="00:32:00" sendTimeout="00:10:00" transactionFlow="false" hostNameComparisonMode="StrongWildcard" maxBufferPoolSize="524288" maxReceivedMessageSize="2147483647"&gt;
          &lt;readerQuotas maxDepth="2147483647" maxStringContentLength="2147483647" maxArrayLength="2147483647" maxBytesPerRead="2147483647" maxNameTableCharCount="2147483647" /&gt;
          &lt;reliableSession ordered="true" inactivityTimeout="00:10:00" /&gt;
          &lt;security mode="TransportWithMessageCredential"&gt;
            &lt;message clientCredentialType="Certificate" algorithmSuite="Default" /&gt;
            &lt;transport clientCredentialType="Windows" protectionLevel="EncryptAndSign" /&gt;
          &lt;/security&gt;
        &lt;/binding&gt;
      &lt;/netTcpBinding&gt;
    &lt;wsHttpBinding&gt;
        &lt;binding name="WSHttpBinding_IThirdPartyRACService" closeTimeout="00:59:00" openTimeout="00:59:00" receiveTimeout="00:59:00" sendTimeout="00:59:00" bypassProxyOnLocal="false" transactionFlow="false" hostNameComparisonMode="StrongWildcard" maxBufferPoolSize="2147483647" maxReceivedMessageSize="2147483647" messageEncoding="Text" textEncoding="utf-8" useDefaultWebProxy="true" allowCookies="false"&gt;
          &lt;readerQuotas maxDepth="32" maxStringContentLength="2147483647" maxArrayLength="2147483647" maxBytesPerRead="2147483647" maxNameTableCharCount="2147483647" /&gt;
          &lt;reliableSession ordered="true" inactivityTimeout="00:10:00" enabled="false" /&gt;
          &lt;security mode="None"&gt;
            &lt;message clientCredentialType="None" negotiateServiceCredential="true" algorithmSuite="Default" establishSecurityContext="true"&gt;&lt;/message&gt;
            &lt;transport clientCredentialType="None" /&gt;
          &lt;/security&gt;
        &lt;/binding&gt;
      &lt;/wsHttpBinding&gt;
    &lt;/bindings&gt;
    &lt;client&gt;
      &lt;endpoint address="net.Tcp://localhost:8004/AMACService" behaviorConfiguration="ClientBehavior" binding="netTcpBinding" bindingConfiguration="netTcpBinding_RACService" contract="ServerImpl.Rsp.ServiceInterfaces.IRACService" name="IRACService"&gt;
        &lt;identity&gt;
          &lt;dns value="RACServer" /&gt;
        &lt;/identity&gt;
      &lt;/endpoint&gt;
      &lt;endpoint address="net.Tcp://localhost:8004/AMACService" behaviorConfiguration="ClientBehavior" binding="netTcpBinding" bindingConfiguration="netTcpBinding_RACService" contract="ServerImpl.Rsp.ServiceInterfaces.IRACService" name="IRACService1"&gt;
        &lt;identity&gt;
          &lt;dns value="RACServer" /&gt;
        &lt;/identity&gt;
      &lt;/endpoint&gt;
    &lt;endpoint address="https://localhost/ThirdPartyWebService/ThirdPartyRACService.svc" binding="wsHttpBinding" bindingConfiguration="WSHttpBinding_IThirdPartyRACService" contract="IThirdPartyRACService" name="WSHttpBinding_IThirdPartyRACService"&gt;
        &lt;identity&gt;
          &lt;dns value="localhost" /&gt;
        &lt;/identity&gt;
      &lt;/endpoint&gt;
    &lt;/client&gt;
    &lt;behaviors&gt;
      &lt;endpointBehaviors&gt;
        &lt;behavior name="ClientBehavior"&gt;
          &lt;clientCredentials&gt;
            &lt;clientCertificate findValue="RACClient" storeLocation="LocalMachine" storeName="My" x509FindType="FindBySubjectName" /&gt;
            &lt;serviceCertificate&gt;
              &lt;defaultCertificate findValue="RACServer" storeLocation="LocalMachine" storeName="My" x509FindType="FindBySubjectName" /&gt;
              &lt;authentication certificateValidationMode="PeerOrChainTrust" revocationMode="NoCheck" /&gt;
            &lt;/serviceCertificate&gt;
          &lt;/clientCredentials&gt;
          &lt;dataContractSerializer maxItemsInObjectGraph="2147483647" /&gt;
        &lt;/behavior&gt;
      &lt;/endpointBehaviors&gt;
    &lt;/behaviors&gt;
&lt;/system.serviceModel&gt;
</code></pre>

<p>If we set the security mode to "None" on <strong>both</strong> the client and the server then it works.</p>

<p>What can be wrong here?</p>