Hello All.

Problem with my x509 makecert certificates for WSE 3.0

I am having problems getting the WSE certificates to work on a simple test
system before I apply this to an existing product. I have installed
walk-through certificates and these appear to work without a problem. I have
made several attempts to create my own certificates and setup WSE but always
come to the same problem.

What am I doing wrong?

Server Logs report the following error:
    Exception thrown: WSE600: Unable to unwrap a symmetric key using the
private key of an X.509 certificate. Please check if the account
'RNDNOTEPM\ASPNET' has permissions to read the private key of certificate
with subject name 'CN=DevServer2' and thumbprint
'5644C8F29B69C5DD07DE2F5B0C65E88E3604CE2D'.

Client Logs report the following error:
Exception thrown: WSE2005: Protection requirements in
MutualCertificate11Assertion are not satisfied.

The certificates have been created with makecert:
           makecert -sk DevServer -pe -ss my -sr LocalMachine -n
CN=DevServer"

makecert -sk DevClient -pe -ss my -sr LocalMachine -n CN=DevClient"

The WSE tool was used to allow aspnet access to the private keys and the
permissions have been checked in windows explorer.

The Service Policy file is:
<policies xmlns="http://schemas.microsoft.com/wse/2005/06/policy">
 <extensions>
   <extension name="mutualCertificate10Security"
type="Microsoft.Web.Services3.Design.MutualCertificate10Assertion,
Microsoft.Web.Services3, Version=3.0.0.0, Culture=neutral,
PublicKeyToken=31bf3856ad364e35" />
   <extension name="x509"
type="Microsoft.Web.Services3.Design.X509TokenProvider,
Microsoft.Web.Services3, Version=3.0.0.0, Culture=neutral,
PublicKeyToken=31bf3856ad364e35" />
   <extension name="requireActionHeader"
type="Microsoft.Web.Services3.Design.RequireActionHeaderAssertion,
Microsoft.Web.Services3, Version=3.0.0.0, Culture=neutral,
PublicKeyToken=31bf3856ad364e35" />
   <extension name="authorization"
type="Microsoft.Web.Services3.Design.AuthorizationAssertion,
Microsoft.Web.Services3, Version=3.0.0.0, Culture=neutral,
PublicKeyToken=31bf3856ad364e35" />
 </extensions>
 <policy name="x509">
   <authorization>
     <allow user="CN=DevClient" />
     <deny user="*" />
   </authorization>
   <mutualCertificate11Security establishSecurityContext="true"
renewExpiredSecurityContext="true" requireSignatureConfirmation="true"
messageProtectionOrder="SignBeforeEncryptAndEncryptSignature"
requireDerivedKeys="true" ttlInSeconds="300">
     <serviceToken>
       <x509 storeLocation="LocalMachine" storeName="AddressBook"
findValue="CN=DevServer" findType="FindBySubjectDistinguishedName" />
     </serviceToken>
     <protection>
       <request signatureOptions="IncludeAddressing, IncludeTimestamp,
IncludeSoapBody" encryptBody="true" />
       <response signatureOptions="IncludeAddressing, IncludeTimestamp,
IncludeSoapBody" encryptBody="true" />
       <fault signatureOptions="IncludeAddressing, IncludeTimestamp,
IncludeSoapBody" encryptBody="false" />
     </protection>
   </mutualCertificate11Security>
   <requireActionHeader />
 </policy>
</policies>

And the client policy file is:
<policies xmlns="http://schemas.microsoft.com/wse/2005/06/policy">
 <extensions>
   <extension name="mutualCertificate10Security"
type="Microsoft.Web.Services3.Design.MutualCertificate10Assertion,
Microsoft.Web.Services3, Version=3.0.0.0, Culture=neutral,
PublicKeyToken=31bf3856ad364e35" />
   <extension name="x509"
type="Microsoft.Web.Services3.Design.X509TokenProvider,
Microsoft.Web.Services3, Version=3.0.0.0, Culture=neutral,
PublicKeyToken=31bf3856ad364e35" />
   <extension name="requireActionHeader"
type="Microsoft.Web.Services3.Design.RequireActionHeaderAssertion,
Microsoft.Web.Services3, Version=3.0.0.0, Culture=neutral,
PublicKeyToken=31bf3856ad364e35" />
 </extensions>
 <policy name="x509">
   <mutualCertificate11Security establishSecurityContext="true"
renewExpiredSecurityContext="true" requireSignatureConfirmation="true"
messageProtectionOrder="SignBeforeEncrypt" requireDerivedKeys="true"
ttlInSeconds="300">
     <clientToken>
       <x509 storeLocation="LocalMachine" storeName="My"
findValue="CN=DevClient" findType="FindBySubjectDistinguishedName" />
     </clientToken>
     <serviceToken>
       <x509 storeLocation="LocalMachine" storeName="My"
findValue="CN=DevServer" findType="FindBySubjectDistinguishedName" />
     </serviceToken>
     <protection>
       <request signatureOptions="IncludeAddressing, IncludeTimestamp,
IncludeSoapBody" encryptBody="true" />
       <response signatureOptions="IncludeAddressing, IncludeTimestamp,
IncludeSoapBody" encryptBody="true" />
       <fault signatureOptions="IncludeAddressing, IncludeTimestamp,
IncludeSoapBody" encryptBody="false" />
     </protection>
   </mutualCertificate11Security>
   <requireActionHeader />
 </policy>
</policies>