getting started with WCF Routing with certificate authentication- stuck in XML hell

Question

I have a simple WCF Client -> Server structure, where the client references the server's WCF service. Authentication is done using X509 certificates.

I want to add a simple form of redundancy to my service. meaning- to have several servers running, and have the client use a router that would transparently fail-over to a backup server if the main one is dead.
Simple, right?

I used the hello world sample code and just changed the app.config file of my router to resemble that of my client.
I then pointed my client at the router.

The only reward I got for my pains was An insecured or incorrectly secured fault exception, with the inner exception saying:
The message could not be processed. This is most likely because the action 'http://www.MyCompany.com/MyApp/api/IMyCompanyMyAppService/GetItems' is incorrect or because the message contains an invalid or expired security context token or because there is a mismatch between bindings. The security context token would be invalid if the service aborted the channel due to inactivity. To prevent the service from aborting idle sessions prematurely increase the Receive timeout on the service endpoint's binding.

Obviously all of those reasons are a blatant lie (the GetItems method is implemented, the binding aren't mismatched since I copy-pasted them from my client configuration, and there's nothing wrong with my receive timeout).

Now I'm at a loss as to what to do; I have a hunch this might have something to do with the authentication method I use (X509 certificates), but I really don't have a clue.

Enclosed are the configurations for the server, router and client.

<!--SERVER CONFIGURATION-->
  <system.serviceModel>
    <bindings>

            <basicHttpBinding>
        <binding name="MyAppService_BasicHttpBindingConfigurationSSL" 
                                 maxBufferPoolSize="1073741824" maxBufferSize="1073741824" maxReceivedMessageSize="1073741824">
                    <readerQuotas maxDepth="32" maxStringContentLength="8192" maxArrayLength="1073741824"
                        maxBytesPerRead="4096" maxNameTableCharCount="16384" />
          <security mode="Transport">
            <transport clientCredentialType="Basic" proxyCredentialType="None"/>
          </security>
        </binding>
      </basicHttpBinding>

      <wsHttpBinding>
        <binding name="MyAppService_BindingConfiguration" maxBufferPoolSize="1073741824" maxReceivedMessageSize="1073741824">
                    <readerQuotas maxDepth="32" maxStringContentLength="8192" maxArrayLength="1073741824"
                        maxBytesPerRead="4096" maxNameTableCharCount="16384" />
          <security mode="Message">
            <transport/>
            <message clientCredentialType="Certificate" negotiateServiceCredential="false" establishSecurityContext="false"/>
          </security>
        </binding>
        <binding name="MyAppService_BindingConfigurationOverSSL" maxBufferPoolSize="1073741824" maxReceivedMessageSize="1073741824">
                    <readerQuotas maxDepth="32" maxStringContentLength="8192" maxArrayLength="1073741824"
                        maxBytesPerRead="4096" maxNameTableCharCount="16384" />
          <security mode="TransportWithMessageCredential">
            <transport/>
            <message clientCredentialType="Certificate" negotiateServiceCredential="false" establishSecurityContext="false"/>
          </security>
        </binding>
      </wsHttpBinding>
    </bindings>

    <services>
      <service name="MyCompany.MyApp.MyAppService.Server.Service.MyCompanyMyAppService" behaviorConfiguration="MyAppService_Behavior">
        <!-- Non-SSL endpoint -->
        <endpoint name="MyAppServiceEndpoint"
                                    address="http://localhost:8087/MyAppService" 
                                    binding="wsHttpBinding" 
                                    bindingNamespace="http://www.MyCompany.com/api/binding" 
                                    bindingConfiguration="MyAppService_BindingConfiguration" 
                                    behaviorConfiguration="WSDLBehavior" 
                                    contract="MyCompany.MyApp.MyAppService.Common.Services.IMyCompanyMyAppService"/>
        <!-- SSL endpoint -->
        <endpoint name="MyAppServiceEndpointSSL" 
                                    address="https://localhost:8088/MyAppService" 
                                    binding="wsHttpBinding" 
                                    bindingNamespace="http://www.MyCompany.com/api/binding" 
                                    bindingConfiguration="MyAppService_BindingConfigurationOverSSL" 
                                    behaviorConfiguration="WSDLBehavior" 
                                    contract="MyCompany.MyApp.MyAppService.Common.Services.IMyCompanyMyAppService"/>
        <!--BasicHttpBinding-->
        <!--SSL BasicHttpBinding -->
        <endpoint name="MyAppServiceEndpointBasicSSL" 
                                    address="https://localhost:8088/MyAppServiceBasic" 
                                    bindingConfiguration="MyAppService_BasicHttpBindingConfigurationSSL" 
                                    binding="basicHttpBinding" 
                                    contract="MyCompany.MyApp.MyAppService.Common.Services.IMyCompanyMyAppService" />
        <!-- Non-SSL Metadata endpoint -->
        <endpoint name="MyAppServiceBinding" address="http://localhost:8087/mex" binding="mexHttpBinding" behaviorConfiguration="WSDLBehavior" contract="IMetadataExchange"/>
      </service>
    </services>

    <behaviors>
      <endpointBehaviors>
        <behavior name="WSDLBehavior">
          <!--<wsdlExtensions />-->
        </behavior>
      </endpointBehaviors>

      <serviceBehaviors>
        <behavior name="MyAppService_Behavior">
          <serviceCredentials>
            <userNameAuthentication userNamePasswordValidationMode="Custom" 
                                                                        customUserNamePasswordValidatorType="MyCompany.MyApp.MyAppService.Server.Service.MyAppUsernamePasswordValidator, MyCompany.MyApp.MyAppService.Server" />

            <clientCertificate>
              <authentication certificateValidationMode="PeerOrChainTrust" revocationMode="NoCheck"/>
              <certificate/>              
            </clientCertificate>
            <serviceCertificate storeLocation="LocalMachine" 
                                                                storeName="My" x509FindType="FindBySubjectName" findValue="server.dev.MyApp.MyCompany.com"/>
          </serviceCredentials>
          <!-- Allow the service to handle a high load of calls and sessions -->
          <serviceThrottling maxConcurrentCalls="300" maxConcurrentInstances="500" maxConcurrentSessions="30000"/>
          <serviceMetadata httpGetEnabled="true" httpGetUrl="http://localhost:8087/mex" httpsGetEnabled="false" httpsGetUrl="https://localhost:8088/mex"/>
        </behavior>
      </serviceBehaviors>
    </behaviors>

  </system.serviceModel>

<!--ROUTER CONFIGURATION-->  
<system.serviceModel>
    <services>
      <!--ROUTING SERVICE -->
      <service behaviorConfiguration="routingData"
          name="System.ServiceModel.Routing.RoutingService">
        <host>
          <baseAddresses>
            <add  baseAddress="http://localhost:8000/MyAppService"/>
          </baseAddresses>
        </host>
        <endpoint address=""
                  binding="wsHttpBinding"
                  name="reqReplyEndpoint"
                  contract="System.ServiceModel.Routing.IRequestReplyRouter" />
        <endpoint address="mex"
                  binding="mexHttpBinding"
                  contract="IMetadataExchange"  />
      </service>
    </services>

    <bindings>
      <basicHttpBinding>
        <binding name="MyAppServiceEndpointBasicSSL" closeTimeout="00:01:00"
          openTimeout="00:01:00" receiveTimeout="00:10:00" sendTimeout="00:01:00"
          allowCookies="false" bypassProxyOnLocal="false" hostNameComparisonMode="StrongWildcard"
          maxBufferSize="65536" maxBufferPoolSize="524288" maxReceivedMessageSize="65536"
          messageEncoding="Text" textEncoding="utf-8" transferMode="Buffered"
          useDefaultWebProxy="true">
          <readerQuotas maxDepth="32" maxStringContentLength="8192" maxArrayLength="16384"
            maxBytesPerRead="4096" maxNameTableCharCount="16384" />
          <security mode="Transport">
            <transport clientCredentialType="Basic" proxyCredentialType="None"
              realm="" />
            <message clientCredentialType="UserName" algorithmSuite="Default" />
          </security>
        </binding>
      </basicHttpBinding>
      <wsHttpBinding>
        <binding name="MyAppServiceEndpoint" maxBufferPoolSize="1073741824" maxReceivedMessageSize="1073741824">
          <readerQuotas maxDepth="32" maxStringContentLength="8192" maxArrayLength="1073741824"
                        maxBytesPerRead="4096" maxNameTableCharCount="16384" />
          <security mode="Message">
            <transport/>
            <message clientCredentialType="Certificate" negotiateServiceCredential="false" establishSecurityContext="false"/>
          </security>
        </binding>
        <binding name="MyAppServiceEndpointSSL" maxBufferPoolSize="1073741824" maxReceivedMessageSize="1073741824">
          <readerQuotas maxDepth="32" maxStringContentLength="8192" maxArrayLength="1073741824"
                        maxBytesPerRead="4096" maxNameTableCharCount="16384" />
          <security mode="TransportWithMessageCredential">
            <transport/>
            <message clientCredentialType="Certificate" negotiateServiceCredential="false" establishSecurityContext="false"/>
          </security>
        </binding>
      </wsHttpBinding>
    </bindings>

    <behaviors>
      <serviceBehaviors>
        <behavior name="routingData">
          <serviceMetadata httpGetEnabled="True"/>
          <routing filterTableName="routingTable1" />
        </behavior>
      </serviceBehaviors>
    </behaviors>
    <client>
      <endpoint address="http://localhost:8087/MyAppService" binding="wsHttpBinding"
        bindingConfiguration="MyAppServiceEndpoint" contract="MyCompanyMyAppService.IMyCompanyMyAppService"
        name="MyAppServiceEndpoint">
        <identity>
          <certificate encodedValue="AwAAAAEAAAAUAAAAS2hv3zJGGxe4T0jo4fwcBgc2fbogAAAAAQAAABYCAAAwggISMIIBf6ADAgECAhDtT0KoiuHcoERR+GfWnIJJMAkGBSsOAwIdBQAwHzEdMBsGA1UEAxMUZGV2LmNybS5sZXZlcmF0ZS5jb20wHhcNMTExMTA5MDgyNDQ2WhcNMTMxMjMwMjIwMDAwWjAmMSQwIgYDVQQDExtzZXJ2ZXIuZGV2LmNybS5sZXZlcmF0ZS5jb20wgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAMsBWu9R/c65MNdQRDkCi4w5uyxp4Hh5FK0hyUh9LzObQuSuMvqYc+cW1OuI1b4G1RBNOwGOzxUeK+dPX6Q5Y96qcmOk5+eJyPOg2dtHaOujGvaW1MN/sVJPMy6xgCtJ6iSe9xDYYmxcha2quZK3LGGvW3d3/QznBqY+XwK6kbHXAgMBAAGjUDBOMEwGA1UdAQRFMEOAEP3fipkit68H++sodJuSZSWhHTAbMRkwFwYDVQQDExBjcm0ubGV2ZXJhdGUuY29tghAluuQuFlNJpU+Yh7Yf725TMAkGBSsOAwIdBQADgYEAZVECKrndJdjMYnfSb2bCByv24mpgE2yCuhm2Ey+cSEwP31aKrHIVNAcVDPd7k1/R4qsWU6I8PHjVCeCHTMnf+EE/1IV0lbCj/PD/D3by+m/7hEKdtzk6VHJyJLmLyO6fIJc14XPI4qC/KVuUS97UjNpWcICZFgM64Vb7MUW5thE=" />
        </identity>
      </endpoint>
      <endpoint address="https://localhost:8088/MyAppService" binding="wsHttpBinding"
        bindingConfiguration="MyAppServiceEndpointSSL" contract="MyCompanyMyAppService.IMyCompanyMyAppService"
        name="MyAppServiceEndpointSSL" />
      <endpoint address="https://localhost:8088/MyAppServiceBasic" binding="basicHttpBinding"
        bindingConfiguration="MyAppServiceEndpointBasicSSL" contract="MyCompanyMyAppService.IMyCompanyMyAppService"
        name="MyAppServiceEndpointBasicSSL" />
    </client>
    <!--ROUTING SECTION -->
    <routing>
      <filters>
        <filter name="MatchAllFilter1" filterType="MatchAll" />
      </filters>
      <filterTables>
        <filterTable name="routingTable1">
          <add filterName="MatchAllFilter1" endpointName="MyAppServiceEndpoint" />
        </filterTable>
      </filterTables>
    </routing>
  </system.serviceModel>



<!--CLIENT CONFIGURATION-->  
<system.serviceModel>
    <client>
      <endpoint address="http://localhost:8087/MyAppService" binding="wsHttpBinding"
        bindingConfiguration="MyAppServiceEndpoint" contract="MyCompanyMyAppService.IMyCompanyMyAppService"
        name="MyAppServiceEndpoint">
        <identity>
          <certificate encodedValue="AwAAAAEAAAAUAAAAS2hv3zJGGxe4T0jo4fwcBgc2fbogAAAAAQAAABYCAAAwggISMIIBf6ADAgECAhDtT0KoiuHcoERR+GfWnIJJMAkGBSsOAwIdBQAwHzEdMBsGA1UEAxMUZGV2LmNybS5sZXZlcmF0ZS5jb20wHhcNMTExMTA5MDgyNDQ2WhcNMTMxMjMwMjIwMDAwWjAmMSQwIgYDVQQDExtzZXJ2ZXIuZGV2LmNybS5sZXZlcmF0ZS5jb20wgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAMsBWu9R/c65MNdQRDkCi4w5uyxp4Hh5FK0hyUh9LzObQuSuMvqYc+cW1OuI1b4G1RBNOwGOzxUeK+dPX6Q5Y96qcmOk5+eJyPOg2dtHaOujGvaW1MN/sVJPMy6xgCtJ6iSe9xDYYmxcha2quZK3LGGvW3d3/QznBqY+XwK6kbHXAgMBAAGjUDBOMEwGA1UdAQRFMEOAEP3fipkit68H++sodJuSZSWhHTAbMRkwFwYDVQQDExBjcm0ubGV2ZXJhdGUuY29tghAluuQuFlNJpU+Yh7Yf725TMAkGBSsOAwIdBQADgYEAZVECKrndJdjMYnfSb2bCByv24mpgE2yCuhm2Ey+cSEwP31aKrHIVNAcVDPd7k1/R4qsWU6I8PHjVCeCHTMnf+EE/1IV0lbCj/PD/D3by+m/7hEKdtzk6VHJyJLmLyO6fIJc14XPI4qC/KVuUS97UjNpWcICZFgM64Vb7MUW5thE=" />
        </identity>
      </endpoint>
      <endpoint address="https://localhost:8088/MyAppService" binding="wsHttpBinding"
        bindingConfiguration="MyAppServiceEndpointSSL" contract="MyCompanyMyAppService.IMyCompanyMyAppService"
        name="MyAppServiceEndpointSSL" />
      <endpoint address="https://localhost:8088/MyAppServiceBasic" binding="basicHttpBinding"
        bindingConfiguration="MyAppServiceEndpointBasicSSL" contract="MyCompanyMyAppService.IMyCompanyMyAppService"
        name="MyAppServiceEndpointBasicSSL" />
    </client>
    <bindings>
      <basicHttpBinding>
        <binding name="MyAppServiceEndpointBasicSSL" closeTimeout="00:01:00"
          openTimeout="00:01:00" receiveTimeout="00:10:00" sendTimeout="00:01:00"
          allowCookies="false" bypassProxyOnLocal="false" hostNameComparisonMode="StrongWildcard"
          maxBufferSize="65536" maxBufferPoolSize="524288" maxReceivedMessageSize="65536"
          messageEncoding="Text" textEncoding="utf-8" transferMode="Buffered"
          useDefaultWebProxy="true">
          <readerQuotas maxDepth="32" maxStringContentLength="8192" maxArrayLength="16384"
            maxBytesPerRead="4096" maxNameTableCharCount="16384" />
          <security mode="Transport">
            <transport clientCredentialType="Basic" proxyCredentialType="None"
              realm="" />
            <message clientCredentialType="UserName" algorithmSuite="Default" />
          </security>
        </binding>
      </basicHttpBinding>
      <wsHttpBinding>
        <binding name="MyAppServiceEndpoint" closeTimeout="00:01:00" openTimeout="00:01:00"
          receiveTimeout="00:10:00" sendTimeout="00:01:00" bypassProxyOnLocal="false"
          transactionFlow="false" hostNameComparisonMode="StrongWildcard"
          maxBufferPoolSize="524288" maxReceivedMessageSize="65536" messageEncoding="Text"
          textEncoding="utf-8" useDefaultWebProxy="true" allowCookies="false">
          <readerQuotas maxDepth="32" maxStringContentLength="8192" maxArrayLength="16384"
            maxBytesPerRead="4096" maxNameTableCharCount="16384" />
          <reliableSession ordered="true" inactivityTimeout="00:10:00"
            enabled="false" />
          <security mode="Message">
            <transport clientCredentialType="Windows" proxyCredentialType="None"
              realm="" />
            <message clientCredentialType="Certificate" negotiateServiceCredential="false"
              algorithmSuite="Default" establishSecurityContext="false" />
          </security>
        </binding>
        <binding name="MyAppServiceEndpointSSL" closeTimeout="00:01:00"
          openTimeout="00:01:00" receiveTimeout="00:10:00" sendTimeout="00:01:00"
          bypassProxyOnLocal="false" transactionFlow="false" hostNameComparisonMode="StrongWildcard"
          maxBufferPoolSize="524288" maxReceivedMessageSize="65536" messageEncoding="Text"
          textEncoding="utf-8" useDefaultWebProxy="true" allowCookies="false">
          <readerQuotas maxDepth="32" maxStringContentLength="8192" maxArrayLength="16384"
            maxBytesPerRead="4096" maxNameTableCharCount="16384" />
          <reliableSession ordered="true" inactivityTimeout="00:10:00"
            enabled="false" />
          <security mode="TransportWithMessageCredential">
            <transport clientCredentialType="None" proxyCredentialType="None"
              realm="" />
            <message clientCredentialType="Certificate" negotiateServiceCredential="true"
              algorithmSuite="Default" establishSecurityContext="false" />
          </security>
        </binding>
      </wsHttpBinding>
    </bindings>



  </system.serviceModel>

Answer 1

well, it seems like at the moment there is no solution;
It seems that WCF only supports windows credentials method (See here).
so it's back to the drawing board... If anyone's interested- this is the direction I went in.