Note that client will sign message using its private key and encrypt using server's public key while server while sending response will sign with his private key and encrypt using clients public key
Solution -
We tried using Test certificate which has DN = "Test" as server's private key and it worked fine.
we configured wcf webservice with private key of test.pfx and java axis client with public key of test.pfx. We used verisign original certificate as client private key.
Request has
Response has
2)
By using verisign certificate, we also tried using
3)
We looked at java axis source code, to see how it contructs X509IssuerName in soap message, code says that is follows RFC 2253 (http://www.ietf.org/rfc/rfc2253.txt) , so it seems that Java axis is normalizing the IssuerName as per rfc 2253 i.e No spaces after comma between CN and OU and so on. Also it uses \ to esacpe comma inside O=VeriSign, Inc. as per rfc 2253
e.g (CN=VeriSign Class 2 MPKI Individual Subscriber CA - G2,OU=Terms of use at https://www.verisign.com/rpa (c)08,OU=VeriSign Trust Network,O=VeriSign\, Inc.,C=US),
So it seems that wcf does not support above normalization
----------------------------
Client - Axis-2 Version 1.3 with Rampart version 1.3
Service - WCF Service with message level security on .Net3.5 service SP1
Web.config of WCF Web Service is
1.
We are trying to consume above WCF web service which is using Message Level Security [using client and server certificates.]. WCF service throws Soap Fault exception saying " An error occurred when verifying security for the message.".
After enabling message level logging on WCF service, we see following error in event viewer:
Message authentication failed.
Service: http://xxx/Gateway/v2.0/Authentication.svc
Action: http://xxxxxx/v2.0/Authentication/Login
ClientIdentity:
ActivityId:
MessageSecurityException: The EncryptedKey clause was not wrapped with the required encryption token 'System.IdentityModel.Tokens.X509SecurityToken'.
Soap message created by Axis2 client is
t+xlmsXcb2w+vjV6Sg05Lk6r75W7UnoMkvJNijW9cC1ddVGRwFA5hf5MEgT3IjkavjN6xE+UFf2s
NoWsXUQuqnUrsugWB2X47Ad68Xurq5gBPwkqxGv6fI/w1OZmh28hw1mMBLuX8BvL2+2Lzq4dh3zW
jIh64hqQjKYxW5O+ZPkiib+JJ/Tl6XYiVN8v5JvQlzv+BzgfMDKHEjKtEnDtNc4BnDM3EZxC0OVx
t8b+5H00oJS6gtn/zw/LaOVOkNe5Pa6hDRNEgYdo8JlYKPfR0gHc3JIxqfbwn260v/j0b6QcGWfw
gHv1sHwlWOOe1T9BtF0cH6wZabFPxDf6h8LQZdc9YpA6S65JCf6p9IhOSU/rB0K//8G8mrF5P1Kd
4ThwAgpfWF4N3ZO93xRt3Kg6y6SOkaF7fTkqgdFTtR3eo9g+a9N0GCfm+cuzfgyEjFdwzrM1P6fd
4A4PTqICNZXmzLrLSTV5zkcyLDPqDAi/7Ts1iXq8zGCiGJMRlOdw65akYkMctFH8yw4Ry3Py2cA5
KK5cB/Rm5TnJfLCRDvySJ2UYDZ6TcI2Zh7jDPyll2PPeKnlEGxutHTh7MT5u/Cny4uQYJgRVSeZ9
fNc6m9ZeaBmvdT8VShIAWianxB7cCwM7so9AEsinAunRtkUS7YQ2DKbfQi97RYiAZkEw4ty2AsmY
J1l3Y1v8aCUNcH3GPdY2AIH8LhsYyP9B/s07DYfQMFlhq2W0lp+R3b56NQPfi9irP5zMhevrCroA
h7LmBQywksbRvHwphQQLA5j1guz/pB+Tf5It3KPeO0WLa263hHwuS+lsfubKIQHTi45k9ehfjLUC
ypcheFz/oqVr+lbiPqBpluPEqSYxK6pEm4byLaVo7cfkCcl3J7J+cn+xHa4l1Nr97BOc6d6KmBb6
ykI5VYGCyS8HiQ1nZURqcH+kJSiO3DKqhUDtQYFcZUzS3TfcCt9H7B52+/FwF7J1RDd34+XGA5aQ
/BGEWeRxA745KCYkVxYZWWc7p6pbbteXcltyIfp/5R+Si1L8S6JEKmLkNOgUY6XJpUQq26fwh4O+
fdLt5v3IdDdoajXoIVNy6o9s8w32RSzW7JxS2PM9vgbDA8tRNnZVsHTKvY4fIymcVAgW0PtuveVS
ExrjRUf1zlqc5AikO64qNwUUzR9NE421iFJsUBeaeUEwHQWvLTUwkvFNnxWYOX4FZHd6i85iOuyP
wgpLl8kLHlhqgp8agou9VgiVgrkLQUh/wL7OKZBpoARxWzBBKGcQdAbpvBzl09vR4B+aI7Qftokh
ilgSoTCjduJ0MpEGoiVa1en0i9ZGVZLxD2UttUw7Ng7AAyQw8Eczly03A4RJe4QHhoR0u82tvBnx
423Tdmv8DWUNPYYnO1U/mT98SBI05Y9dPcs8IJj1DHl1vxtXr8BuC3944M7EAhK7BVnoFhfqlflK
EDxYGCeYavmrxRc7t7G+nKueIGrXBAdgzxT07zCQmrEwYx8hNYpGhEo/U4j3uBgPmSQfy0UhHKBl
iZMWSjJg1IlRWif5/S70CJaGpeHYnlQgEmbaW3VuQPjQh4Jd+Z7js3uCfgTWEg5lpkiLs5Nh6VkL
4iS5el4gghTmmW2N8zKEWaBWhK8a1Jn9gVGq1RtHXxOTlXrK7tcRe/9sFYqY1aaIPxNNk6x+qDkL
aSxJIZQdiezRj5J9iJln6yD7h4lAVL7xh7gIgIzM82K8jdgZ6fufXtwtVwQC4F14RkQzwY8YArRf
TH1wy8YqQZrPTVsDM00bm56BZvcyVJFlK7sUuYb8/ouFeUd8mCgsXHZcWT6BjzrFw6vLKKXfscQE
Q7IrTbKFZJiQ13CNCLdq8qkgQ43wR0RXo0eJZmrx/299FJuk3Ouek9ZZ7f8/+IvqngNqBcr3fzT+
RwdKHdu6+h0zfWE+JL2wxw+JkZg5HOKkyhRtFslCT9DWYaAWT0gnzoORr1fO4VKBzkCu9ipHWHP5
BWVSN8Pg/eHldMGGhdo4eUThH/C21crpQUZhih/woJQlgCZNOEny3wMvFGgGPFTHB1tDlRS8ROXD
1zVNxJZEbrpm8ge9qw3QjbT/SUcrvZy22Car3922vOQxPUeA5+mFZvS5vPWilx9n/yGNJZxSlgls
4P9agPu3sDgfiJ1H50T20+OmF6Lgfk+0KXI2d0/Jt0ygeFa5bNLwMwd1C4EayRJAfv5wvgWHG/3+
zVAT13voDkgaPTWW7wL2xlvLyQCpFLez/IoCf1WDNgvARO74M9RKKmCYrtChQNjg7ExJh16NhAFW
CR4vV/Tnbaku3CR2g2KxjT/r0SXDVcIMnnU85oiBwmI8rg4ryGMStsvJ4eGFVDwL/AhUWwnlJL5M
a+EEBb0PB9jnaaYD6YuVYwtVLkq5OcIjRl/00V9lcb3mG4ZX/oDC9gAV/Gd4i6U3YihqJKEPoNSL
f82weoOKtA8+UlU1vMgb99fQIJJBzGUlxE6ohaxA9bo=
sbQ1GgLj0kyqvrF335TNeBy4iGwIpyVDFXUt56N2AzFqLjb/Au/AUU1PClLaZIkD9P6VsE3Vv0Ba
1K/eDTPdAF0FSLA25CgXHabe35w1taegyrm/dXyIx5x11VNgtGGMF7hLABjvkjnlTYfk5E8/MeSO
wNX/iy2UWyTmtB04+dbUiPMTD7xw+xdLvk2SOCiFAD/CVCqEeDW+sm5MZbKOIdsTuxUU7D6S9i2W
YXVWKlcCn6Bl1jlM8+mR4mmX6AWDYjUly3nJzbE/ufZjD7QICYUaCPBtNFv7pEscImsdQjbfa2VJ
mUi3PUMIDM/OXlPHeX/nL69DCYcxI8IMyFP2demfKtytrvc5ZI5rnlmTSylvnioEXMxQqca31igR
ibrEx2axI3MuWH+nQcf2FOuXBv5Zrs6rQaJ/KGy8OzE2b+1s2xXQEFtyqDv9xzbwaQrlYnDWzDlN
eBGKWaYf2Czj2xvQz0kBMUVF891KxNks1e6dnWnw5pbtmLi3YERp7mVsX8W4ly9SKyyauRrU01rN
Jyhay2VdNW6p+9yFqpFlTxp3eoLnZiFnIHrWv+4GHl0l
2.
We are able to consume same WCF service using wcf client using same server and client certificates.
The soap message in this case is
Wcf client app.config is:
3.
Using same Axis2 client and same certificates, we are able to talk to Sample Axis2 Web service [which uses same certificates] successfully, That means certificates are right and soap evelope produced by Axis 2 client is understood by Axis Service and same soap envelope is not understood by WCF service.
So there seems some interoperability issue ??
There also seems some difference between X509IssuerName element in soap envelope genreated by Axis 2 Java client and WCF .net clien
