problems encrypting Soap message using X.509 cert generated from makecert

eshayne_at_bigfoot.com
Date: 12/10/04 

Date: 10 Dec 2004 13:23:27 -0800

I am trying to create a simple "hello world" web service and client
that uses X.509 to encrypt the message, all in C# using Visual Studio
2003 and WSE 2.0 SP1.

I have tried using both the sample certificate supplied with WSE 2.0 as
well as generating my own certificate using makecert.

When I use the WSE sample certificate, I have found it works either if
I install the private key on the client and the public certificate on
the server; or if I install the public certificate on the client and
the private key on the server. (Using the "Current User" store on the
client, and the "Local Machine" store on the server.) Either way, I can
use the same certificate key id on the client to get the certificate
and add an EncryptedData security element to my Soap context on the
client side. The server correctly handles the incoming message either
way. (Though I am a bit confused by the naming of the WSE-supplied
certificate files - the only private and public *pair* is named "Server
Public" and "Server Private" - there is no "Client Public," so for the
above-described test I was forced to use the Server keys.)

My understanding is that if I put the private key on the client and the
public certificate on the server, what I am essentially doing is
ensuring that on the server-side, I can securely believe that the
message came from that particular client - because nobody else should
have that private key. Conversely, if I put the private key on the
server and the public certificate on the client, that essentially would
mean that I am ensuring that only the server can read the message - but
anyone could have sent it.

Then I tried to create my own certificate instead of using the
WSE-supplied sample - using the same client and server code and config
files, only changing the key id used by the client to find the
certificate. I generated the certificate using makecert (makecert -n
"MyTestCert" -sv MyTestCert-private.pvk -sky exchange
MyTestCert-public.cer), and extracted the private key using cert2spc
(cert2spc MyTestCert-public.cer MyTestCert-public.spc) and pvkimprt
(pvkimprt -pfx MyTestCert-public.spc MyTestCert-private.pvk).

Unfortunately, using the key id for my own certificate - I can only use
this certificate by putting the private key on the server and the
public certificate on the client. If I do it the other way around, the
server complains that it cannot find the private key (which it
shouldn't need).

Or, I can put the private key on the client and the public key on the
server - but then I can only sign the message from the client, I can't
encrypt it (without giving the server the private key as well).
What am I missing here?

Thanks,
Ethan

Relevant Pages

  • Re: Need for encryption in WSE 3.0 if using SS-avoid man-in-middle
    ... SSL only validates you are talking to a SSL certified server; ... They can simply edit the URL the client program ... can be done by using a X.509 certificate on both ends, ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: LDP client authentication fails
    ... I got the LDP working with LDAP server under server client authentication ... I did not installed the certificate in pfx format .. ... Client cert auth won't work without that. ...
    (microsoft.public.windows.server.active_directory)
  • Re: SSL & Man In the Middle Attack
    ... >> it possible for the middle man to intercept all messages from server to me ... > server sends client a signed message along with a digital certificate. ... > client generates a random secret key, ...
    (comp.security.misc)
  • Re: activesync issue
    ... On the SBS 2003 Server open the Server Management console. ... On the "Web Server Certificate" page, choose to create a new Web server ... Install the new certificate which created in above step on mobile device: ... Access to browse the Exchange Server 2003 client after you install ...
    (microsoft.public.windows.server.sbs)
  • Re: Need for encryption in WSE 3.0 if using SS-avoid man-in-middle
    ... order to detect we are connected to the wrong server (even though its SSL ... certificate is OK and valid by Verisign); we would need a client certificate. ... this can be detected by SSL/HTTPS client in ...
    (microsoft.public.dotnet.framework.aspnet.security)