Here is some code to use both a server and client certificate. Hope it
helps. Works with WSE 3.0 Oct CTP

Replace MyCertificate with your client certificate and ServerCertificate
with the servers

           MutualCertificate11Assertion assertion = new
MutualCertificate11Assertion();
           X509TokenProvider clientToken = new X509TokenProvider();
           clientToken.StoreLocation = StoreLocation.LocalMachine;
           clientToken.StoreName = StoreName.My;
           clientToken.FindType =
X509FindType.FindBySubjectDistinguishedName;
           clientToken.FindValue = "CN=MyCertificate";

           object o = clientToken.GetToken();

           assertion.ClientX509TokenProvider = clientToken;
           assertion.ServiceX509TokenProvider = new
X509TokenProvider(StoreLocation.LocalMachine, StoreName.My,
"CN=ServerCertificate", X509FindType.FindBySubjectDistinguishedName);

           o = assertion.ServiceX509TokenProvider.GetToken();

           assertion.Protection.Request.SignatureOptions =
SignatureOptions.IncludeAddressing | SignatureOptions.IncludeTimestamp |
SignatureOptions.IncludeSoapBody;
           assertion.Protection.Request.EncryptBody = true;
           assertion.Protection.Response.SignatureOptions =
SignatureOptions.IncludeAddressing | SignatureOptions.IncludeTimestamp |
SignatureOptions.IncludeSoapBody;
           assertion.Protection.Response.EncryptBody = true;
           assertion.Protection.Fault.SignatureOptions =
SignatureOptions.IncludeAddressing | SignatureOptions.IncludeTimestamp |
SignatureOptions.IncludeSoapBody;
           assertion.Protection.Fault.EncryptBody = false;

           assertion.RequireSignatureConfirmation= true;
           assertion.RequireDerivedKeys = true;
           assertion.MessageProtectionOrder =
MessageProtectionOrder.SignBeforeEncrypt;
           assertion.EstablishSecurityContext = true;
           assertion.RenewExpiredSecurityContext = true;
           assertion.ClientActor = "";

           Policy p = Policy(new PolicyAssertion[] { assertion });