I ran into trouble during deploying a WCF service on IIS7 with https.
There's a great resource on all things WCF Security related here
http://www.codeplex.com/WCFSecurity
This helped me a lot.
Disclaimer Postings are provided as is with no warranties, and confer no rights. Opinions expressed here are my own delusions; my employers at best shake their heads and sigh, at worst repudiate the content with extreme prejudice, whenever it manages to appear on their radar.