Hi Olivier,

I have already discussed this topic with you before. WCF tries to negociate
a service certificate with the protocol TLSNego when you use the binding
wsHttpBinding.
You have two ways of avoiding that behavior:

1. Disable the negotiateServiceCredentials flag on the wsHttpBinding
2. Use a custom binding, as I show below (It uses UsernameOverCertificate
but you can modify it to use MutualCertificate).

<system.serviceModel >
  <client>
  <endpoint name="clientendpoint"
address="http://localhost/WCFSampleService/service.svc"
   binding="wsFederationHttpBinding"
   contract="IHelloWorld"
   behaviorConfiguration="ServiceBehavior"
   bindingConfiguration="ServiceBinding">
   <identity>
    <dns value="WCFQuickstartServer"/>
   </identity>
  </endpoint>
 </client>

 <bindings>

  <customBinding>
   <binding name="UsernameBinding">
    <security authenticationMode="UserNameForCertificate"
                      requireSignatureConfirmation="false"
      messageProtectionOrder ="SignBeforeEncryptAndEncryptSignature"
      requireDerivedKeys="true">
    </security>
    <httpTransport/>
   </binding>
  </customBinding>

  <wsFederationHttpBinding>
   <binding name="ServiceBinding">
    <security mode="Message">
     <message
issuedTokenType="http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1"
negotiateServiceCredential="false">
      <!-- Uncomment this section to ask for specific claims to the STS
      <claims>
       <add claimType
="http://schemas.microsoft.com/ws/2005/05/identity/claims/EmailAddress"/>
       <add claimType
="http://schemas.microsoft.com/ws/2005/05/identity/claims/GivenName"/>
       <add claimType
="http://schemas.microsoft.com/ws/2005/05/identity/claims/Surname"/>
      </claims>
      -->

      <issuer
address="http://localhost/WCFSecurityTokenService/service.svc"
bindingConfiguration="UsernameBinding"
       binding="customBinding">
       <identity>
        <dns value="WCFQuickstartServer"/>
       </identity>
      </issuer>
     </message>
    </security>
   </binding>
  </wsFederationHttpBinding>
 </bindings>
 <behaviors>
  <behavior name="ServiceBehavior">
   <clientCredentials>

    <serviceCertificate>
     <defaultCertificate findValue="CN=WCFQuickstartServer"
storeLocation="LocalMachine" storeName="My"
x509FindType="FindBySubjectDistinguishedName"/>
     <authentication revocationMode="NoCheck"
certificateValidationMode="None"></authentication>
    </serviceCertificate>
   </clientCredentials>
  </behavior>
 </behaviors>
</system.serviceModel>

This works on the February CTP.

Regards,
Pablo Cibraro
http://weblogs.asp.net/cibrax