BasicHttpBinding with Certificate authentication - error "forbidden"?

Try adding this in the client just after setting Security.Mode:

binding.Security.Transport.ClientCredentialType = HttpClientCredentialType.Certificate;