WCF / ASMX :: Message Security And Encryption

I need to get message integrity by encrypting the data while dataflow between Service <-> client (by directional). Below are the details.

Development Environment: .net framework 4.0; Windows 7, IIS7, VS2010.
Production Environment: .net framework 4.0; Windows 2008, IIS7.
Business Requirement:

I have an WCF Service hosted in IIS7. There are multiple Windows Forms Application as clients to my service. Services will be consumed via internet.User, Role information are stored in SQL Server 2008 database. Need to Authenticate and Authorize requests agains the SQL Server database. Dataflow is bi-directional. Clients will write data to service. And also Service will serve data to clients Data transfered in wires must be encrypted, in both directions. My approch to solution:

Below is the configuration setting in Service web.config file.
<system.serviceModel> <bindings> <wsHttpBinding> <binding name="POCWsHttpBinding"> <security mode="Message"> <message clientCredentialType="UserName" negotiateServiceCredential="true" /> </security> </binding> </wsHttpBinding> </bindings> <services> <service behaviorConfiguration="POCServiceBehaviour" name="SecurityPOC.SecuredService"> <endpoint address="" binding="wsHttpBinding" bindingConfiguration="POCWsHttpBinding" name="POCwsHttpBindingEndPoint" contract="SecurityPOC.ISecuredService" /> </service> </services> <behaviors> <serviceBehaviors> <behavior name="POCServiceBehaviour"> <serviceMetadata httpGetEnabled="true" /> <serviceDebug includeExceptionDetailInFaults="false" /> <serviceCredentials> <serviceCertificate findValue="CN=WCFServer" storeLocation="LocalMachine" storeName="My" x509FindType="FindBySubjectDistinguishedName" /><userNameAuthentication userNamePasswordValidationMode="Custom" customUserNamePasswordValidatorType="Common.MyCustomUsernamePasswordValidator, Common" /> </serviceCredentials> </behavior> </serviceBehaviors> </behaviors> <serviceHostingEnvironment multipleSiteBindingsEnabled="true" /> </system.serviceModel>

Questions & Assumptions:

My assumption is that, client certificate is used for authentication. I am not using Certificates at Client side, becuase my client authentication will be done using UserNameValitions against the Database.

Am I write? Using only Server side Certificate, with negotiateServiceCredential="true".

Is it required is install Server certificate on client machines in this case?
I am assuming Server Certificate details will be downloaded to client site during the first call..
<security mode="Message">,
Assuming this setting takes care about the message security/encryption using the Server certificate, in both directions. As per my requirement, message must encryped on wire while tranfer between Server to client and while Client to Server.

Am I write?
My Last question...How to ensure that messages are being encripted on both directions, from Testing point-of-view. I need to take test evidences out of it.