The HTTPS/SSL session is established automatically by the browser when one
browses to a HTTPS site. The client and server can now securely send and
receive information. One can dig in deeper by looking at the TLS/SSL
specifications.

Now the question is - Why do I need to install a server certificate on the
client when HTTPS does not need it? Well, the answer is that WSE clients and
sites do not negotiate like HTTPS/SSL. This is a major shortcoming of WSE.
Wouldn't it be  nice to have an API/ability that will negotiate a security
context token automatically? This way one can secure the username token also.

In previous threads (by Williams), a method to extact a public key from the
.snk file generated by the sn tool is described. This way, one does not need
certificates on the clients.

Maybe someone can shed light on why there is no API/ability to establish a
seesion like browsing to a HTTPS site with a browser does ? I find it an
amazing flaw. At least, an API that will get the public certificate from the
server would be nice so one does not have to worry about having clients to
install one.

Even with a certificate on a client, you can find several articles on how to
secure the Username token which is not entirely satisfactory. In this case,
one can send a fake UserName token to get the Security Context token. After
that, you can use Security Context token to secure the Username token.