Unable to unwrap a symmetric key using the private key of an X.509 -- dotnet web services enhancements

Chris Fink
6/12/2006 11:50:02 AM

I have walked through all of the WSE 3 Hands on Labs and got everything
working fine. When I create my own certificate and install it in the stores,
my client application that is consuming my WSE enabled webservice receives
the following error (noted at the very bottom of this post).

My objective here is to create and secure a service application (webservice)
using an x509 test cert that requests a client certificate; and to create a
test client to consume this service.

Following the makecert command that I used:
makecert -pe -n "CN=DecisionOne Corporation" -ss root -sr localmachine
DecisionOneEBSServices.cer

I installed this cert along with the embedded private key to the following
stores:
Current User - personal, trusted root, and other people stores
Local Computer - personal, trusted root, and other people stores

Using the WSE 3.0 certificates tool, I gave FULL access to Everyone and the
ASPNET user for all the 6 stores.

I enabled allow test roots in my WSE 3.0 settings>security for BOTH the
client and the webservice.

Following is the policy file for my client:
<policies xmlns="http://schemas.microsoft.com/wse/2005/06/policy">
<extensions>
<extension name="usernameForCertificateSecurity"
type="Microsoft.Web.Services3.Design.UsernameForCertificateAssertion,
Microsoft.Web.Services3, Version=3.0.0.0, Culture=neutral,
PublicKeyToken=31bf3856ad364e35" />
<extension name="mutualCertificate11Security"
type="Microsoft.Web.Services3.Design.MutualCertificate11Assertion,
Microsoft.Web.Services3, Version=3.0.0.0, Culture=neutral,
PublicKeyToken=31bf3856ad364e35" />
<extension name="x509"
type="Microsoft.Web.Services3.Design.X509TokenProvider,
Microsoft.Web.Services3, Version=3.0.0.0, Culture=neutral,
PublicKeyToken=31bf3856ad364e35" />
<extension name="requireActionHeader"
type="Microsoft.Web.Services3.Design.RequireActionHeaderAssertion,
Microsoft.Web.Services3, Version=3.0.0.0, Culture=neutral,
PublicKeyToken=31bf3856ad364e35" />
</extensions>
<policy name="DellCertPolicy">
<mutualCertificate11Security establishSecurityContext="false"
renewExpiredSecurityContext="true" requireSignatureConfirmation="true"
messageProtectionOrder="SignBeforeEncrypt" requireDerivedKeys="true"
ttlInSeconds="300">
<clientToken>
<x509 storeLocation="CurrentUser" storeName="My"
findValue="CN=DecisionOne Corporation"
findType="FindBySubjectDistinguishedName" />
</clientToken>
<serviceToken>
<x509 storeLocation="LocalMachine" storeName="AddressBook"
findValue="CN=DecisionOne Corporation"
findType="FindBySubjectDistinguishedName" />
</serviceToken>
<protection>
<request signatureOptions="IncludeAddressing, IncludeTimestamp,
IncludeSoapBody" encryptBody="true" />
<response signatureOptions="IncludeAddressing, IncludeTimestamp,
IncludeSoapBody" encryptBody="true" />
<fault signatureOptions="IncludeAddressing, IncludeTimestamp,
IncludeSoapBody" encryptBody="false" />
</protection>
</mutualCertificate11Security>
<requireActionHeader />
</policy>
</policies>

Following is the policy file for my webservice:
<policies xmlns="http://schemas.microsoft.com/wse/2005/06/policy">
<extensions>
<extension name="usernameForCertificateSecurity"
type="Microsoft.Web.Services3.Design.UsernameForCertificateAssertion,
Microsoft.Web.Services3, Version=3.0.0.0, Culture=neutral,
PublicKeyToken=31bf3856ad364e35" />
<extension name="mutualCertificate11Security"
type="Microsoft.Web.Services3.Design.MutualCertificate11Assertion,
Microsoft.Web.Services3, Version=3.0.0.0, Culture=neutral,
PublicKeyToken=31bf3856ad364e35" />
<extension name="x509"
type="Microsoft.Web.Services3.Design.X509TokenProvider,
Microsoft.Web.Services3, Version=3.0.0.0, Culture=neutral,
PublicKeyToken=31bf3856ad364e35" />
<extension name="requireActionHeader"
type="Microsoft.Web.Services3.Design.RequireActionHeaderAssertion,
Microsoft.Web.Services3, Version=3.0.0.0, Culture=neutral,
PublicKeyToken=31bf3856ad364e35" />
</extensions>
<policy name="DellCertPolicy">
<mutualCertificate11Security establishSecurityContext="false"
renewExpiredSecurityContext="true" requireSignatureConfirmation="true"
messageProtectionOrder="SignBeforeEncrypt" requireDerivedKeys="true"
ttlInSeconds="300">
<serviceToken>
<x509 storeLocation="LocalMachine" storeName="My"
findValue="CN=DecisionOne Corporation"
findType="FindBySubjectDistinguishedName" />
</serviceToken>
<protection>
<request signatureOptions="IncludeAddressing, IncludeTimestamp,
IncludeSoapBody" encryptBody="true" />
<response signatureOptions="IncludeAddressing, IncludeTimestamp,
IncludeSoapBody" encryptBody="true" />
<fault signatureOptions="IncludeAddressing, IncludeTimestamp,
IncludeSoapBody" encryptBody="false" />
</protection>
</mutualCertificate11Security>
<requireActionHeader />
</policy>
</policies>

And finally, the ERROR from the event viewer.

Event Type: Error
Event Source: Microsoft WSE 3.0
Event Category: None
Event ID: 0
Date: 6/12/2006
Time: 2:27:58 PM
User: N/A
Computer: WMDVFRA002
Description:
System.ApplicationException: WSE841: An error occured processing an outgoing
fault response. ---> System.Web.Services.Protocols.SoapException:
System.Web.Services.Protocols.SoapException: Server was unable to process
request. ---> System.Security.Cryptography.CryptographicException: WSE600:
Unable to unwrap a symmetric key using the private key of an X.509
certificate. Please check if the account 'WMDVFRA002\ASPNET' has permissions
to read the private key of certificate with subject name 'CN=DecisionOne
Corporation' and thumbprint '32213F525B6DD6A8FDCA2D1E0876B873F44C759B'. --->
System.Security.Cryptography.CryptographicException: WSE593: Unable to
decrypt the key. Please check if the process has the right permission to
access the private key. --->
System.Security.Cryptography.CryptographicException: Bad Key.

at
System.Security.Cryptography.CryptographicException.ThrowCryptogaphicException(Int32 hr)
at System.Security.Cryptography.Utils._DecryptKey(SafeKeyHandle hPubKey,
Byte[] key, Int32 dwFlags)
at System.Security.Cryptography.RSACryptoServiceProvider.Decrypt(Byte[]
rgb, Boolean fOAEP)
at
Microsoft.Web.Services3.Security.Cryptography.RSA15KeyExchangeFormatter.DecryptKey(Byte[] cipherKey)
--- End of inner exception stack trace ---
at
Microsoft.Web.Services3.Security.Cryptography.RSA15KeyExchangeFormatter.DecryptKey(Byte[] cipherKey)
at Microsoft.Web.Services3.Security.EncryptedKey.Decrypt()
--- End of inner exception stack trace ---
at Microsoft.Web.Services3.Security.EncryptedKey.Decrypt()

Pablo Cibraro
6/13/2006 9:35:10 AM

Hi,

The problem is related to the certificate store on the web service side.
You installed the certificate in "OtherPeople" store but the policy points
to the store "My", which is the personal store..

1. You should change the policy to use "AddressBook" or
2. You should install the certificate in the "Personal" store.

Regards,
Pablo Cibraro
http://weblogs.asp.net/cibrax

[quoted text, click to view]

Chris Fink
6/14/2006 7:48:02 AM

Pablo,

I appreciate your assistance, but your recommendation did not solve my
problem; I am still receiving the same error.

I modified my webservice's policy to point to AddressBook store instead of
My, as follows:

<x509 storeLocation="LocalMachine" storeName="AddressBook"
findValue="CN=DecisionOne Corporation"
findType="FindBySubjectDistinguishedName" />

I recompiled the webservice and then updated the webreference from the
client and the client still gets the same error.

Unchanged from my previous post, the certificate (public and private key) is
installed in the personal store of both local computer and current user and I
have given proper permissions to everyone for all of the certs in all stores.

Is it possible that my cert was not created properly with makecert? I can't
seem to figure out why I was able to get the lab sample working, but not my
own.

Any help is appreciated!

[quoted text, click to view]

MHoque
7/18/2006 9:42:02 AM

I am having the same problem while using Hands on Lab doc. Plus the Hands on
Doc seems to be poorly written since it is skipping few important steps. Does
any one know of a reworked Hands on lab doc.

[quoted text, click to view]

amit
7/19/2006 12:39:21 PM

[quoted text, click to view]

roger_27
10/13/2006 4:11:02 PM

I HAVE DISCOVERED THE SOLUTION!!!

ms-help://MS.WSE30.1033/WSE3.0/html/b5a8bce9-31a2-444c-a762-86f5bf2abd96.htm

this was the correct URL, follow step #2 exactly.

once you try running it again it should work. it doesnt work you say ?

right click your solution and pick "Rebuild Solution" then run it.

the problem is that in microsofts tutorial it doesn't mention you need to
REBUILD the solution after you have given ASPNET right, not just build. I'm
not 100% sure the reason, but I think it has to do with the changes done in
the <process model> node in the machine.config file. these changes do not
reflect untill you rebuild the solution. this worked for me, and I tested it
on the machine next to me, then I tested it again on the machine next to me.
this has fixed the problem all 3 times. I am about 90% sure this will solve
the problem for you.

also, if ASPNET is not found in the list of accounts, (in the certificate
tool, after you have selected to view private key file properties, and then
clicked the "security" tab, then clicked "add"), you need to click
"Locations", highlight your computer (which is usually the top most node)
then click "OK" then type "ASPNET" in the "Enter object names" box and click
OK. ASPNET should be added now. all you need to assign it is read/read &
execute rights.

hope this helps. I am the champion!

Got something to say? Click here to post a reply to this thread.

Don't see what you're looking for? Try a search.

View other messages about dotnet web services enhancements

dotnet web services enhancements : Unable to unwrap a symmetric key using the private key of an X.509