We wrote a WCF service and deployed it on IIS on our company's internal server A which is NOT connected to the internet.
We developed an ASP.NET web page which consumes that service. The web page is located on another server B in our company. Server B is both connected to server A and to the internet. The web page is accessible through the internet by everyone.
I should secure communication between the service and the web page, so I've read about WCF security in this article which describes a case almost similar to our case except for authenticating users against database (which we don't have), and they have WCF as a Windows service and not on IIS.
Should I go with the scenario described in the article?
And, will I need any kind of certificate for web-page - service communications? (P.S.: if yes, we will rely on self-signed certificate because we can't obtain one from an authority)