Also, if this is for a site where you have control of the client environment (intranet). Its possible, although I'm not sure of this, that you might be able to allow this access if you add http://openstreetmap.org to the trusted sites on the client machines. But, again, I'm not sure what your outcome might be.

I think you are having problems due to the cross-scheme access. Your Silverlight application was fetched using the HTTPS scheme, and you are trying to talk to OpenStreetMap using the HTTP scheme, which Silverlight is denying, I presume, due to the security violation of your more secure zone trying to talk to a less secure zone. It's possible you may be able to allow this behavior in the ClientAccessPolicy, but I suspect it doesn't let you allow calling from a secure zone to a less secure zone, only the other way around (but I could be wrong about this ;-) )

One approach would be to proxy the requests for the map tiles on your server using an HTTPS enpoint, but this would obviously increase your bandwidth burden on your server, since you would be piping the map images from OpenStreetMap.

Another approach would be to see if any of our supported tile source providers have an HTTPS service you can use rather than an HTTP service.

Yet another approach is to examine your SSL usage. Why do you need the SSL for the silverlight application? Could only the secure parts of the application elevate to SSL, or does the user need to see the HTTPS in the browser address bar? This is a common issue to address when a map is displayed in an HTTPS site, and I believe some approach it by having multiple iframes where some of the content of the page is secure and some is insecure (something most sensible browsers generate a warning about, by the way). In this way, it may be possible to host multiple silverlight applications on a page in different security zones. But you would want to investigate further along these lines.

Hope this info helps! let me know if you have any questions.

-Graham