Transport security with WCF, IIS, as well as client authentication .. is this possible or not?

Question

I can find out a few similar questions about this, but I'm completely unsure of the answer to this. I become more and more confused when I read in different ways. Therefore, I ask this for my satisfaction.

I have a WCF service hosted in IIS. and I have a client that connects to this service and calls the method. Now I am trying to use certificates to use transport security.

On the client side, I have a config

<bindings> <basicHttpBinding> <binding name="testBinding"> <security mode="Transport"> <transport clientCredentialType="Certificate" proxyCredentialType="Basic"/> </security> </binding> </basicHttpBinding> </bindings> <behaviors> <endpointBehaviors> <behavior name="testBehavior"> <clientCredentials> <clientCertificate storeLocation="LocalMachine" storeName="My" x509FindType="FindBySubjectName" findValue="client007"/> </clientCredentials> </behavior> </endpointBehaviors> </behaviors> 

On the server side, I have a configuration

 <behaviors> <serviceBehaviors> <behavior name="testServiceBehavior"> <serviceMetadata httpsGetEnabled="true"/> <serviceDebug includeExceptionDetailInFaults="true"/> <serviceCredentials> <clientCertificate> <authentication certificateValidationMode="PeerTrust" trustedStoreLocation="LocalMachine"/> </clientCertificate> </serviceCredentials> </behavior> </serviceBehaviors> </behaviors> <bindings> <basicHttpBinding> <binding name="testServiceBinding"> <security mode="Transport"> <transport clientCredentialType="Certificate"/> </security> </binding> </basicHttpBinding> </bindings> 

Now, the script I want, only a client that has its public key installed on trusted server users, can only access the service.

But in my case, whether I install the public key in proxies or not. I can access the service using any certificate that I create myself.

I checked that anonymous authentication was enabled, because of this? When I turn off anonymous access, I get an error

The HTTP request is unauthorized with client authentication, authentication received from the server was the core area

How can I make sure that only the client whose public key is on the server can access the service?

Does this validation work with transport security? Please help me. thank