We strongly advocate that directors configure the gateway to work with a sound certification which has been signed by a CA. It is the accountability of the application to implement protected bindings on its endpoint. Services host isn't going to deliver any security over and above exactly what is configured http://zygohub.pl/