CustomCertificateValidator not called when Client certificates are on “accepted” in IIS

Question

I have the following situation:

I am looking for the possibility to authenticate a user at a wcf rest service optionally by username/password or by certificate. I have 2