<bindings>
      <customBinding>
        <binding name="Example_TestBinding">
          <security defaultAlgorithmSuite="TripleDesRsa15"
                    authenticationMode="MutualCertificate"
                    requireDerivedKeys="false"
                    includeTimestamp="false"
                    messageProtectionOrder="SignBeforeEncrypt"
                    messageSecurityVersion="WSSecurity10WSTrust13WSSecureConversation13WSSecurityPolicy12BasicSecurityProfile10"
                    requireSignatureConfirmation="false">
            <localClientSettings detectReplays="true"/>
            <localServiceSettings detectReplays="true"/>
          </security>
          <textMessageEncoding messageVersion="Soap11"/>
          <httpsTransport authenticationScheme="Basic" manualAddressing="false" maxReceivedMessageSize="524288000" transferMode="Buffered"/>
        </binding>
      </customBinding>
    </bindings>
  <client>
    <endpoint
      address="https://blabla.hana.ondemand.com/Example_Test"
      binding="customBinding"
      bindingConfiguration="Example_TestBinding"
      contract="WebServiceTest.Example_Test"
      name="Example_Test"
     />
  </client>

var client = new Example_TestClient();
            client.ClientCredentials.UserName.UserName = "user";
            client.ClientCredentials.UserName.Password = "pass";

            X509Certificate2 certClient = new X509Certificate2(certClientPath, certClientPassword);
            client.ClientCredentials.ClientCertificate.Certificate = certClient;

            X509Certificate2 certService= new X509Certificate2(certServicePath);
            client.ClientCredentials.ServiceCertificate.DefaultCertificate = certService;

            var response = client.Example_Test(requestObj);

"The EncryptedKey clause was not wrapped with the required
encryption token 'System.IdentityModel.Tokens.X509SecurityToken'."
    at System.ServiceModel.Security.WSSecurityJan2004.WrappedKeyTokenEntry.CreateWrappedKeyToken(String id, String encryptionMethod, String carriedKeyName, SecurityKeyIdentifier unwrappingTokenIdentifier, Byte[] wrappedKey, SecurityTokenResolver tokenResolver)rn ...