Everyone-

I'm looking into an architecture model of securing web service traffic without adding any code changes, and without using self-signed certificates.  The goal is to use CA issued certificates, and to authenticate against the CN of the certificate that the client is passing.

Going directly to WAS and setting up QoS doesn't work, as it doesn't get fine grained to authenticate the certificate based on the CN.

So the decision/path I am looking to employ is Mutual Auth at the IIS (webserver) layer.  And restricting the communication to WAS.

In IIS, we can setup 'many-to-one' rules with SSL certificates, and associate the rule to a user account, such as a service ID in MS AD.  We then configure the rule to match the CN of the certificate we choose to allow, and deny all other certs.  And setting the IIS site to Require SSL and Require Client certificates locks the site down.

From IIS to WAS, we have the secure plugin configuration.

In WAS, we only set the Vhost to allow the IP/URL:Port combination from the IIS site.

Furthermore, in WAS, we set IP restrictions on the web transport to only allow the DNS/IP:Port of the IIS server.  This assures that there will not be any direct communication to the web transport around IIS.

All that said, I'm looking for any comments, as to if there is anything else that should be done to further secure the web service call?