Question

How do I ensure my WCF service is over HTTPS and all communication is over HTTPS?

Theres nothing in my web.config file of the service that says http://… or https://….

HTTPS is set up in IIS and I can access the web service via http and https.

Or is this not required if it’s encrypted anyway with message level security?

<bindings>
  <wsHttpBinding>
    <binding name="Binding1" maxReceivedMessageSize="20000000">
      <security mode="Message">
        <message clientCredentialType="UserName"/>
      </security>
    </binding>
  </wsHttpBinding>
</bindings>

Answer 1

HTTPS is HTTP over Transport-Layer Security (TLS). To enable it, you need to configure your binding to use transport security in addition to the existing message-level security:

<bindings>
  <wsHttpBinding>
    <binding name="Binding1" maxReceivedMessageSize="20000000">
      <security mode="TransportWithMessageCredential">
        <message clientCredentialType="UserName"/>
      </security>
    </binding>
  </wsHttpBinding>
</bindings>