Re: WSE 3.0 CertSrv Request

The InputTrace from the Client has the following error message. The
Client OutputTrace looks clean. I am unable to get the Service to spit out
any logging info when using a VS ASP.NET Development Server.

- <soap:Fault>
<faultcode>soap:MustUnderstand</faultcode>
<faultstring>System.Web.Services.Protocols.SoapHeaderException: SOAP
header Security was not understood. at
System.Web.Services.Protocols.SoapHeaderHandling.SetHeaderMembers(SoapHeaderCollection
headers, Object target, SoapHeaderMapping[] mappings, SoapHeaderDirection
direction, Boolean client) at
System.Web.Services.Protocols.SoapServerProtocol.CreateServerInstance() at
System.Web.Services.Protocols.WebServiceHandler.Invoke() at
System.Web.Services.Protocols.WebServiceHandler.CoreProcessRequest()</faultstring>
</soap:Fault>

"Pablo Cibraro [MVP]" <pcibraro@xxxxxxxxxxx> wrote in message
news:OaBGs5b0GHA.3464@xxxxxxxxxxxxxxxxxxxxxxx
Hi,

I need to set the CSP to "Microsoft Enhanced Cryptographic Provider 1.0".
I marked the Key Usage as Both (Exchange and Signature), set the Key Size
to 1024, checked Create new key set, Mark Keys as exportable. I set the
Hash algorithm to SHA-1

All those settings are correct, so what error are you receiving from WSE
when you try to use those certificates ?

Regards,
Pablo Cibraro
http://weblogs.asp.net/cibrax


"Techno_Dex" <nospamchurst@xxxxxxxxxxxx> wrote in message
news:eirCk8SzGHA.3512@xxxxxxxxxxxxxxxxxxxxxxx
I am having a problem creating the appropriate Certificates for mutual
X509 security use our in house Cert Authority with teh CertSrv wizard. I
have not found any good documentation on what type of certificates need to
be created and which parameters need to be set in the CertSrv. I took a
look at Pablo's blog
http://weblogs.asp.net/cibrax/archive/2006/08/08/Creating-X509-Certificates-for-WSE-or-WCF.aspx
but all that does is obscure the CertSrv Template that is used to create
the desired Certifcates instead of explaining which options need to be
set.

So far I am using the Advanced request option in the CertSrv and using
the CA form option to populate the cert details. I'm assuming that the
Intended Purpose is "Server Authentication Certificate" for the WS side
and "Client Authentication Certificate" for the Client side. From
Pablo's blog is appears I need to set the CSP to "Microsoft Enhanced
Cryptographic Provider 1.0". I marked the Key Usage as Both (Exchange
and Signature), set the Key Size to 1024, checked Create new key set,
Mark Keys as exportable. I set the Hash algorithm to SHA-1.... Can
someone shed some light on what I'm missing?





.

Relevant Pages

  • Re: WSE 3.0 CertSrv Request
    ... ASP.NET Development Server caching info like IIS would if it were running ... Client OutputTrace looks clean. ... X509 security use our in house Cert Authority with teh CertSrv wizard. ... I have not found any good documentation on what type of certificates ...
    (microsoft.public.dotnet.framework.webservices.enhancements)
  • On Open Source
    ... server certificate against root certificates when used for client side ... likely to be secure than non-standard or closed source software. ... Client side authentication of the remote host identity is THE ... security service you would normally use SSL/TLS for. ...
    (sci.crypt)
  • Re: SSL and Client Authentication
    ... First I go on my client and I do a browser request from a CA, ... After issuing a cert. ... install (where I verify that this certification was installed ... > It definitely does not sound like the right way to do client certificates. ...
    (microsoft.public.inetserver.iis.security)
  • Re: WSE 3.0 CertSrv Request
    ... it seems that something is bad configured on the server side. ... Client OutputTrace looks clean. ... X509 security use our in house Cert Authority with teh CertSrv wizard. ... have not found any good documentation on what type of certificates need ...
    (microsoft.public.dotnet.framework.webservices.enhancements)
  • Re: WSE 3.0 CertSrv Request
    ... You can also find the response message in the Response ... Client OutputTrace looks clean. ... X509 security use our in house Cert Authority with teh CertSrv wizard. ... I have not found any good documentation on what type of certificates ...
    (microsoft.public.dotnet.framework.webservices.enhancements)