Querying an HTTPS SOAP service fails in C#

first of all, i know near to nothing about SOAP (and i really hoped i'd be lucky enough to stay away from it), so pardon my total ignorance.

I need to call (from the .NET 4 Framework) some functions on an old SOAP service made in Java but for some reason i am unable to do so and i don't understand why since everything worked on a test environment with HTTP inside a VPN.

I tried other solutions found here and online but nothing seems to work and i cannot access the log on the SOAP server to see exactly what goes wrong.

I know that the service works because SoapUI (version 5.7.0) can communicate with it without a problem.

In SoapUI, in the Outgoing WS-Security Configurations page i added these WSS Entries:

• Timestamp
• Signature
• Encryption

as told by the service provider, i don't know if it matters.

This is how the client used to work inside the test environment (with HTTP):

var myBinding = new BasicHttpBinding();
myBinding.Security.Mode = BasicHttpSecurityMode.Message;
myBinding.Security.Message.ClientCredentialType = BasicHttpMessageCredentialType.Certificate;
myBinding.Security.Message.AlgorithmSuite = SecurityAlgorithmSuite.TripleDes;
myBinding.MaxReceivedMessageSize = 2 * 1024 * 1024;
var ei = EndpointIdentity.CreateDnsIdentity("test");
var aec = new AddressHeaderCollection();
var ea = new EndpointAddress(new Uri("http://endpointurl/servicename"), ei, aec);
var client = new DonorportalServiceInsiel.DonorportalServicePortClient(myBinding, ea);
client.ClientCredentials.ServiceCertificate.Authentication.CertificateValidationMode = X509CertificateValidationMode.None;
client.ClientCredentials.ClientCertificate.Certificate = new X509Certificate2(File.ReadAllBytes(@"D:\cert1.p12"), "12345678");
client.ClientCredentials.ServiceCertificate.DefaultCertificate = new X509Certificate2(File.ReadAllBytes(@"D:\cert2.p12"), "12345678");
return client;

As i said, this code worked perfectly inside the test VPN environment.

Unfortunately when i had to move it into production the endpoint address changed, now it is not HTTP anymore, but it is HTTPS... according to the guys that provide this SOAP service nothing else has changed (beside the certificates for signing and encryption which i did update).

Since this code didn't work anymore i tried using the BasicHttpsBinding instead than BasicHttpBinding and i tried BasicHttpsSecurityMode.Transport and also BasicHttpsSecurityMode.TransportWithMessageCredential, but nothing... i get this error: "An error was discovered processing the <wsse:Security> header".

As i said, unfortunately i do not have access to the log on the server side so i don't exactly know what's wrong. I read somewhere that perhaps the body of the message is not getting signed (why??) so i tried adding
client.Endpoint.Contract.ProtectionLevel = System.Net.Security.ProtectionLevel.Sign;
and also
client.Endpoint.Contract.ProtectionLevel = System.Net.Security.ProtectionLevel.EncryptAndSign;
but same error.

I even tried creating my own custom binding but since i don't know what i'm doing i had no success either.

Any help is appreciated.

So far i tried:

• Changing BasicHttpBinding to BasicHttpsBinding
• Changing the security mode from BasicHttpSecurityMode.Message to BasicHttpsSecurityMode.Transport and BasicHttpsSecurityMode.TransportWithMessageCredential (with both BasicHttpBinding and BasicHttpsBinding)
• Trying to force the body signature with System.Net.Security.ProtectionLevel.Sign and System.Net.Security.ProtectionLevel.EncryptAndSign
• Create my own custom binding (but i don't know what i am doing, i tried to follow several examples online but i don't fully understand them)

I do not know your requirements. I believe the requirements are outdated and here is my justification

1. Net Library before Net 4.7.1 did not support all encryption algorithms. You new certificate is not supported with older version of Net
2. You are using Windows 10 which supports all encryption modes
3. TLS 1.2 and 1.3 are only valid TLS versions. Older version are not secure since hackers have broken the encryption mode
4. You are using Net 4.7.2 which is using OS for TLS, instead of Net.
5. Your certificate is SHA-256 (not SecurityAlgorithmSuite.TripleDes). You should not be supporting older encryption modes that are vulnerable.
6. Previous testing is not longer valid if you must use newer encryption algorithms to be secure and to work with your new certificate.

So after many failed attempts i finally made it work.
Since the version in the test environment (which used HTTP with BasicHttpBinding) did work, i compared the binding elements with the production environment (which uses HTTPS) and found that if i use the BasicHttpsBinding the package was not encrypted (i guess because it is already encrypted via HTTPS).

Unfortunately the legacy code on the server, beside using outdated and insecure encryption standards, completely ignored the fact that we were using HTTPS and required the package to be encrypted anyways which made the whole thing fail.

I didn't have access to the server logs so i couldn't figure out what was wrong since it just gave me a generic "An error was discovered processing the <wsse:Security> header" without telling me exactly what was the problem. Since SOAP has, like, 1000 different configurations and options it was quite hard for me to understand what exactly the legacy code on the server didn't like even after several hours/days of failed attempts.

So, as i said, to figure out what was wrong i compared the two bindings and found out that the Security Element was different.

This is the code i used to compare the two bindings:

var httpBinding = new BasicHttpBinding();
httpBinding.Security.Mode = BasicHttpSecurityMode.Message;
httpBinding.Security.Message.ClientCredentialType = BasicHttpMessageCredentialType.Certificate;
httpBinding.Security.Message.AlgorithmSuite = SecurityAlgorithmSuite.TripleDes;
httpBinding.MaxReceivedMessageSize = 2 * 1024 * 1024;
var httpElements = httpBinding.CreateBindingElements();

var httpsBinding = new BasicHttpsBinding();
httpsBinding.Security.Mode = BasicHttpsSecurityMode.TransportWithMessageCredential; // Note that BasicHttpsSecurityMode.Message is not available with BasicHttpsBinding
httpsBinding.Security.Message.ClientCredentialType = BasicHttpMessageCredentialType.Certificate;
httpsBinding.Security.Message.AlgorithmSuite = SecurityAlgorithmSuite.TripleDes;
httpsBinding.MaxReceivedMessageSize = 2 * 1024 * 1024;
var httpsElements = httpsBinding.CreateBindingElements();

I then compared the 3 elements inside the httpElements collection with the 3 elements inside the httpsElements collection and found that the element with index 0 (the Security Binding Element) was different.

By simply adding this line after the code above i managed to make it work for the first time.

httpsElements[0] = httpElements[0];

This was of course a dirty little trick and i didn't like it, but now i knew that if i managed to recreate the Security Element of the BasicHttpBinding i would be able to create a Custom Binding that did work.

So, this is the final working code:

var customBinding = new CustomBinding();

var sbe = (AsymmetricSecurityBindingElement)SecurityBindingElement.CreateMutualCertificateBindingElement(MessageSecurityVersion.WSSecurity10WSTrustFebruary2005WSSecureConversationFebruary2005WSSecurityPolicy11BasicSecurityProfile10);
sbe.DefaultAlgorithmSuite = SecurityAlgorithmSuite.TripleDes;
sbe.MessageProtectionOrder = MessageProtectionOrder.SignBeforeEncryptAndEncryptSignature;
sbe.SecurityHeaderLayout = SecurityHeaderLayout.Lax;

customBinding.Elements.Add(sbe); // Security
customBinding.Elements.Add(new TextMessageEncodingBindingElement(MessageVersion.Soap11, Encoding.UTF8)); // Message
customBinding.Elements.Add(new HttpsTransportBindingElement() { MaxReceivedMessageSize = 2 * 1024 * 1024 }); // Transport

var ei = EndpointIdentity.CreateDnsIdentity("test");
var aec = new AddressHeaderCollection();
var ea = new EndpointAddress(new Uri("https://endpointurl/servicename"), ei, aec);

var client = new DonorportalServiceProduzione.DonorportalServicePortClient(customBinding, ea);
client.Endpoint.Contract.ProtectionLevel = System.Net.Security.ProtectionLevel.EncryptAndSign;
client.ClientCredentials.ServiceCertificate.Authentication.CertificateValidationMode = X509CertificateValidationMode.None;
client.ClientCredentials.ClientCertificate.Certificate = new X509Certificate2(File.ReadAllBytes(@"D:\cert1.p12"), "12345678");
client.ClientCredentials.ServiceCertificate.DefaultCertificate = new X509Certificate2(File.ReadAllBytes(@"D:\cert2.p12"), "");
return client;

To figure out the correct options of the SecurityBindingElement (sbe in the code above) i just pretty much copied the settings in the Security Element of the BasicHttpBinding (httpElements[0] in the code above) and now it works perfectly.

Sorry if the solution is long but i thought that it would have been helpful to explain how i understood what was wrong so that perhaps it can help someone else that finds himself or herself in my same situation, knows nothing about SOAP like me and doesn't know how to tackle the problem.