WCF authentication using ASP.NET Membership Provider

Question

It's been a week already and I'm still not fully comfortable with implementing ASP.NET Membership Provider with WCF. I'm wondering:

1. We already have a website which is running under HTTPS protocol. We are working on a new application which will have a WCF service and is going to replace our old application (with HTTPS). Now my question is, since we already have a secured website, do I have to get another certificate just for the WCF service?

2. If yes, then do I have to get certificates for clients as well? (As I was looking on the web, most of the answers I found were "yes".)

3. If no, can I use the existing certificate to authenticate my service?

Answer 1

To answer your 2nd question, you only need client certificates if you want your WCF service to support mutual (2-way) SSL authentication, in which both the server and client sides are authenticated by their respective certificates.

Refer to this question for further information on mutual ssl and wcf.

how to implement 2-way SSL certificate for WCF

Answer 2

You have to have 1 SSL Certificate per domain unless you purchase a wildcard certificate. So, if your current SSL Certificate is for subdomain.mydomain.com and you want to host the WCF service at anothersubdomain.mydomain.com (or even www.anotherdomain.com), then you'll need another certificate. If this is something that would happen fairly frequently, then I'd suggest you purchase a *.mydomain.com SSL certificate.

Another option would be to host the WCF service under the current subdomain with a URL like subdomain.mydomain.com\\myservice\\service.svc.

I can't answer your second question but I doubt you are using client side certificates.

Here's a link to a Beginner's guide on SSL Certificates .