I have web server (hosted using IIS) in DMZ hosts multiple web services (WCF), the clients are non-server applications (they are standalone .NET application) reaching these web services via internet using the HTTPS protocol.
My server has an SSL certificate issued by Verisign, the point is that my client does not have any type of credential and any machine with that application (or similar app) should be able to consume the services. The information passing between client machine and server must be encrypted and signed.
So this is my question: is having the certificate and using the transport security enough to make sure that nobody can read the messages passing between client and server? Or do I have to somehow come up with some kind of ad hoc client credential and add message security?
This link describes that SSL is good for Intranet and for internet message security is suggested why? What happens if I only use SSL and no message security for the internet scenario?