Hello,

My soap service tries to decrypt soap request messages encrypted with the
server's X509 certificate.
How does WSE2 search for the private key when the coming soap request
inlcuding the WHOLE X509 certificate in the soap header?
I know WSE2 will search for the X509 cert from the specified cert store(say,
machine's) and try to extract the private key from it when given a
X509SubjectKeyIdentifier.
But when I use JWSDP1.4 to send a SOAP request with X509 encryption, it
writes the whole X509 certificate used for the encryption into the SOAP
header rather than use the X509SubjectKeyIdentifier. And, in my prototype
app, WSE2 can not find the corresponding private key which can be found when
using a WSE2 client. Does WSE2 search for the private key only in the
coming-in X509 certificate if there is any?
The following are the error message generated by WSE2 and the input of soap
request.

Thank you very much for any help!

------------------------------------
       <faultstring>System.Web.Services.Protocols.SoapHeaderException:
Server unavailable, please try later ---&gt;
System.InvalidOperationException: Private Key is not available
  at
Microsoft.Web.Services2.Security.Cryptography.RSACryptoServiceProvider.Decry
pt(Byte[] ciphertext, Boolean useOAEP)
  at
Microsoft.Web.Services2.Security.Cryptography.RSA15KeyExchangeFormatter.Decr
yptKey(Byte[] cipherKey)
-------------------------------------
<env:Envelope xmlns:env="http://schemas.xmlsoap.org/soap/envelope/"
xmlns:enc="http://schemas.xmlsoap.org/soap/encoding/" xmlns:ns0
="http://abc.org/" xmlns:xsd="http://www.w3.org/2001/XMLSchema"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
 <env:Header>
   <wsse:Security env:mustUnderstand="1" xmlns:wsse="http://docs.oasis-
open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">
     <wsse:BinarySecurityToken
    EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-
soap-message-security-1.0#Base64Binary" ValueType="http://docs.oasis-
open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3"
xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-
wssecurity-utility-1.0.xsd" wsu:Id="Id2247969495683731141">
    MIIBxDCCAW6gAwIBAgIQYpjr4FOk3IFNSd3lJj6ItzANBgkqhkiG9w0BAQQFADAWMRQwEg
YDVQQD
    EwtSb290IEFnZW5jeTAeFw0wMzA3MDgxODQ4MTBaFw0zOTEyMzEyMzU5NTlaMB8xHTAbBg
NVBAMT
    FFdTRTJRdWlja1N0YXJ0U2VydmVyMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDLkq
glArIn
    ukRlDwXbcjN3zxfsjeaLd+IvfyD5o35pUjpTkPwPXmApScr8UVQxB5JDRSVlMz1lUQ6CBL
FLGIAQ
    OpbPKn2oul3VmKAf9nRQf9PLU+biWozZXkhebIya43D75r5+
5NUq1RbQiCC4qIobRqUdg6adujBY
    333wJy4YgwIDAQABo0swSTBHBgNVHQEEQDA+gBAS5AktBh0dTwCNYSHcFmRjoRgwFjEUMB
IGA1UE
    AxMLUm9vdCBBZ2VuY3mCEAY3bACqAGSKEc+
41KpcNfQwDQYJKoZIhvcNAQEEBQADQQAGSGNKz1gZ
    qbXN8JYl0PQM7ngkHfW1mQ88NRYADmoHw5A/rUZDHAPs5HLSn3i5iXlRwT91v3SU6iuaAi
d+Mwyq
     </wsse:BinarySecurityToken>
     <xenc:EncryptedKey xmlns:xenc="http://www.w3.org/2001/04/xmlenc#">
    <xenc:EncryptionMethod
Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-1_5" />
     <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
        <wsse:SecurityTokenReference>
        <wsse:Reference URI="#Id2247969495683731141"
ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-
token-profile-1.0#X509v3" />
            </wsse:SecurityTokenReference>
        </ds:KeyInfo>
        <xenc:CipherData>
            <xenc:CipherValue>Omk+vX85Qzocq0v+
2NfkTe/DyI/jc+dyl030VQJrHtFvJRrwyvFfq4eoBSk22vAPmdcbbcBXTWq9
       
        /HvtYAEndbOrjeXedPNKJGp4KAwnNH6kjQZxe/YYVbdm3ksglC/vkO3FcEMqCAhD
w1zeMcKArhbp
                8LVBWZQP2t1sLgFJPFU=
            </xenc:CipherValue>
        </xenc:CipherData>
        <xenc:ReferenceList>
            <xenc:DataReference URI="#Id2505756989155604811" />
        </xenc:ReferenceList>
    </xenc:EncryptedKey>
    <wsu:Timestamp xmlns:wsu="http://docs.oasis-
open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
        <wsu:Created>2004-10-22T06:34:45Z</wsu:Created>
    </wsu:Timestamp>
</wsse:Security>
</env:Header