Hi 

I have a use case scenario to expose a custom Apex web service so that it is consumed only over https by an on-premise IIS webserver. I believe the steps to allow this are as follows but I am not sure whether webservices consumed are delivered over http or https and whether I need to do anything extra to tie it down to https. Can someone please advise. Thanks in advance.

1) Generate the enterprise wsdl to allow the external web app to log in and authenticate and obtain a session id ie Develop -> API > Generate Enterprise WSDL
2) Create the custom apex code and esure you check user access eg puesdo code:
     
      global class mySecureWebService {
          webService static Case[] getMyData(String key) {
              // Invoking a custom webService method always uses system context. Therefore write some code to use DescribeSObjectResult Class 
              // and DescribeFieldResult Class to check current user’s access level on the objects and fields that the webService method is accessing. 
              if (i!sValidAccess()) {
                   return null;
              }

              myObject[]  m = [SELECT Id, someotherdata FROM myObject  WHERE Name = :key];
              return m;
          }
      }

3) Generate the custom apex wsdl ie click Develop | Apex Classes > mySecureWebService class  > Click Generate WSDL.

4) Once the WSDL documents have been imported by the .Net application, is the webservice called over https or http? I would like to ensure that the data is transmitted securely and therefore only allow https calls but I am not sure whether I need to do anything else ?  I dont know whether I need to use the Crypto class in the webservice method or generate a certificate to provide to the IIS webserver app or configure Salesforce somewhere to expose the webservice only over https?

Thanks in advance

Adam