IIS - WCF 4.0 Calling Java (Could not establish secure channel for SSL/TLS)

I'm running into a bit of a problem with my WCF service that is trying to talk to a Java Web Service.

I have a ASP.Net MVC front end that is talking to a WCF service over HTTP. The WCF service then talks to a JAVA web service over HTTPS utilising mutual authentication of certificates. The problem currently is that I am getting the following error when the WCF service trys to call the JAVA backend:

Could not establish secure channel for SSL/TLS

On the Java side, I am running JBOSS, with SSL3 and TLS ciphers for the SSL only. The error I have on that end is:

21:49:48,701 INFO  [STDOUT] http-0.0.0.0-8543-2, WRITE: TLSv1 Handshake, length = 1514
21:49:49,499 INFO  [STDOUT] http-0.0.0.0-8543-2, received EOFException: error
21:49:49,499 INFO  [STDOUT] http-0.0.0.0-8543-2, handling exception:   javax.net.ssl.SSLHandshakeException: Remote host closed connection during handshake
21:49:49,507 INFO  [STDOUT] http-0.0.0.0-8543-2, SEND TLSv1 ALERT:  fatal, description = handshake_failure
21:49:49,507 INFO  [STDOUT] http-0.0.0.0-8543-2, WRITE: TLSv1 Alert, length = 2
21:49:49,507 INFO  [STDOUT] http-0.0.0.0-8543-2, called closeSocket()
21:49:49,508 INFO  [STDOUT] http-0.0.0.0-8543-2, called close()

As I'm using mutual authentication of certs, my first port of call was bad certificate. So I have opened up the service wsdl page (also requires authentication of cert), and everything is ok. My Certificates are fine and trusted.

I then started thinking that maybe the cert is not getting put on the service call. So I created a console app that calls the Java service with the same certifcate (looked up via an endpoint behaviour in the config file). Lo and behold, this work fine, and the service response data is shown on the screen.

So that leaves me thinking that there is something in IIS that is stopping the SSL channel being opened, and this is where I need a bit of help really.

My IIS is version 7.0 running on Windows Server 2008 R2. The service is running on .Net 4. (One thing I should point out was that my consle app was running .Net v3.5 not v4.)

I have dabbled a bit in the SCHANNEL settings, but don't really know which settings should be enabled, and which should be disabled. Currently I have:

TLS 1.0/Server/Enabled = 1
SSL 3.0/Server/Enabled = 1
SSL 2.0/Server/Enabled = 1
PCT 1.0/Server/Enabled = 1

I also have:

SSL 2.0/Client/DisabledByDefault = 0

Does anyone have any ideas on where to start?

Thanks in advance, Nick

[UPDATE]

Am now getting the following error in the Windows Error Log:

A fatal error occurred when attempting to access the SSL client credential private key. 
The error code returned from the cryptographic module is 0x8009030d.
The internal error state is 10003.

...but I'm not sure to resolve it. The certifcate is being picked up ok by the looks of this. it just can't get the password.

[Answered]

It turns out that the priviledges on the Certificate hadn't been set for my IIS_IUSRS account.

When I set those up, everything worked fine.