title: Consume a Web Service that requires WS-Security from ASP.NET 4.5 Application
body: <p>I need to consume a web service that requires WS-Security based on X.509 certificates from ASP.NET 4.5 application. So far i have created the web reference but i don't know how implement WS-Security. I have no problem with getting the certificate, but i don't know how to use it in this case, i need to get advice on how to proceed.</p>
  
  <p>My code so far is very basic, i need to add WS-Security to it:</p>
  
  <pre><code>var tere = new serviciotereSoapClient(); 
  tere.ClientCredentials.ClientCertificate.Certificate = myCert;
  var response = tere.agregarGuia( guia );
  </code></pre>
  
  <p>Service configuration:</p>
  
  <pre><code>  &lt;system.serviceModel&gt;
      &lt;bindings&gt;
        &lt;basicHttpBinding&gt;
          &lt;binding name="serviciotereSoapBinding" &gt;
            &lt;security mode="Transport"&gt;
              &lt;transport clientCredentialType="None" proxyCredentialType="None"
                realm="" /&gt;
              &lt;message clientCredentialType="Certificate" algorithmSuite="Default" /&gt;
            &lt;/security&gt;          
          &lt;/binding&gt;
        &lt;/basicHttpBinding&gt;
      &lt;/bindings&gt;
      &lt;client&gt;
        &lt;endpoint address="https://secure.aduana.gov.py/test/tere/serviciotere"
          binding="basicHttpBinding" bindingConfiguration="serviciotereSoapBinding"
          contract="TEREReference.serviciotereSoap" name="serviciotereSoap" /&gt;
      &lt;/client&gt;
    &lt;/system.serviceModel&gt;
  </code></pre>
  
  <blockquote>
    <p><strong>EDIT 1</strong></p>
  </blockquote>
  
  <p>Based on the answer of @TrevorBrooks i came with the following implementation:</p>
  
  <ol>
  <li>Create a service proxy using SvcUtil.exe </li>
  <li>Add wsHttpBinding to
  web.config </li>
  <li>Changed the endpoint to use the binding added in step 2.  </li>
  <li>Changed the code to use the new WCF client.</li>
  </ol>
  
  <p>The web.config now looks like this:</p>
  
  <pre><code>&lt;system.serviceModel&gt;
      &lt;bindings&gt;
        &lt;wsHttpBinding&gt;
          &lt;binding name="WSHttpBinding_TereService" &gt;
            &lt;security mode="Transport"&gt;
              &lt;transport clientCredentialType="None" proxyCredentialType="None"
                realm="" /&gt;
              &lt;message clientCredentialType="Certificate" algorithmSuite="Default" /&gt;
            &lt;/security&gt;
          &lt;/binding&gt;
        &lt;/wsHttpBinding&gt;
      &lt;/bindings&gt;
      &lt;client&gt;
        &lt;endpoint address="https://secure.aduana.gov.py/test/tere/serviciotere"
          binding="wsHttpBinding" bindingConfiguration="WSHttpBinding_TereService"
          contract="serviciotereSoap" name="WSHttpBinding_TereService" /&gt;
      &lt;/client&gt;
    &lt;/system.serviceModel&gt;
  </code></pre>
  
  <p>Now when invoking the service i get ProtocolException with the message:</p>
  
  <p>The content type text / xml; charset = UTF-8 of the response message does not match the content type of the binding (application / soap + xml; charset = utf-8). If using a custom encoder, be sure that the method is implemented properly IsContentTypeSupported. The first 372 bytes of the response were: </p>
  
  <pre><code>        &lt;env:Envelope xmlns:env='http://schemas.xmlsoap.org/soap/envelope/'&gt; 
              &lt;env:Header&gt; &lt;/ env: Header&gt; 
              &lt;env: Body &gt; 
                  &lt;env: Fault xmlns:env='http://schemas.xmlsoap.org/soap/envelope/'&gt;
                  &lt;faultcode&gt;env:Server&lt;/faultcode&gt;
                  &lt;faultstring&gt; org.jboss.ws.core.CommonSOAPFaultException: 
  This service requires &lt;wsse:Security&gt;, which is missing &lt;/ faultstring&gt;. &lt;/ Env: Fault&gt; 
              &lt;/env:Body&gt; 
          &lt;/env:Envelope&gt;
  </code></pre>
  
  <p>This error is a step forward for me because with basicHttpBinding <a href="https://stackoverflow.com/questions/23639003/java-lang-nullpointerexception-when-invoking-java-web-service-from-net">the exception was more horrible</a><br>
  The problem is because the Service requires WS-Security and need to sign the message with a certificate, that is my problem and i cannot yet figure out how to do it.
  In <a href="https://stackoverflow.com/questions/23663007/invoking-a-web-service-with-ws-security-from-net?noredirect=1#comment36349640_23663007">this other question</a> i gave the details too.</p>
  
  <blockquote>
    <p><strong>EDIT 2:</strong>
    I was now provided a sample envelope that works for the service.</p>
  </blockquote>
  
  <pre><code>&lt;soapenv:Header&gt;
    &lt;wsse:Security xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"&gt;
      &lt;wsse:BinarySecurityToken EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary" ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3" wsu:Id="X509-B259DAB3D28E48CB6A140000796019094"&gt;MIIC9TCCAd2gAwIBAgIIUiM4nWs8kfcwDQYJKoZIhvcNAQEFBQAwNzERMA8GA1UEAwwIQWRtaW5DQTExFTATBgNVBAoMDEVKQkNBIFNhbXBsZTELMAkGA1UEBhMCU0UwHhcNMTQwMzIwMTkxMTIwWhcNMTgxMjIwMTQzNzEzWjBBMRQwEgYDVQQDDAtjb3VyaWVyLnRudDEOMAwGA1UECwwFc29maWExDDAKBgNVBAoMA2RuYTELMAkGA1UEBhMCcHkwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAOS71x5+ChwGzWs4VlLgkePbU8/zFHUrrE8nFNVsukMCc5q5hCK8/CeNM+mxImilLdJrGoC2/000lQetB9B3AqIrAdOfBFU4/qsAlgWI+kt2jnUsJMLRjQfxhAKMeX4RUb0CmTcsnXtWlFvYFFjiUi9nUJVSxCsmldVFgLIAHRPjAgMBAAGjfzB9MB0GA1UdDgQWBBTCwBBmU7f/4SmNz7GNJ25ILkPuhjAMBgNVHRMBAf8EAjAAMB8GA1UdIwQYMBaAFDF+1hOSdgg2DFOUofnnXdx9TxjeMA4GA1UdDwEB/wQEAwIE8DAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwDQYJKoZIhvcNAQEFBQADggEBAALVVGGNsTSMcfDBwkkNQH3MpfiNTo/mhH8ahqUVN1+5BIwWstv8fH0Sl9ea1XShKLPDfDIx8WSzUUIt/93f74B3a3oMpBtbVEiku2BKUp5cJfkYe2c5zPOxk3nzmQwcEoB++RgX9DJOtUkKA/It2IM9/8ggUyjceJQCpBRiA9Kg7+h3HfmOKNn+9/pNu498JXhSRKa8Jr4pp/1udYRk+W8sKGEBtAU9MvL3y0AbvLhUD+MZyvpHGB17fslC8Nnd5EBQH8hQD+DWGepyCBIlb0NA13YEoLMcRKDcWvSPd0UGWo2G0IOeUZaGuzzIz2n04QrXvnqQKAOFd9yH2VfGtWE=&lt;/wsse:BinarySecurityToken&gt;
      &lt;ds:Signature Id="SIG-96" xmlns:ds="http://www.w3.org/2000/09/xmldsig#"&gt;
        &lt;ds:SignedInfo&gt;
          &lt;ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" xmlns:ds="http://www.w3.org/2000/09/xmldsig#"&gt;
            &lt;ec:InclusiveNamespaces PrefixList="soapenv web" xmlns:ec="http://www.w3.org/2001/10/xml-exc-c14n#"&gt;&lt;/ec:InclusiveNamespaces&gt;
          &lt;/ds:CanonicalizationMethod&gt;
          &lt;ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" xmlns:ds="http://www.w3.org/2000/09/xmldsig#"&gt;&lt;/ds:SignatureMethod&gt;
          &lt;ds:Reference URI="#id-95" xmlns:ds="http://www.w3.org/2000/09/xmldsig#"&gt;
            &lt;ds:Transforms xmlns:ds="http://www.w3.org/2000/09/xmldsig#"&gt;
              &lt;ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" xmlns:ds="http://www.w3.org/2000/09/xmldsig#"&gt;
                &lt;ec:InclusiveNamespaces PrefixList="web" xmlns:ec="http://www.w3.org/2001/10/xml-exc-c14n#"&gt;&lt;/ec:InclusiveNamespaces&gt;
              &lt;/ds:Transform&gt;
            &lt;/ds:Transforms&gt;
            &lt;ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" xmlns:ds="http://www.w3.org/2000/09/xmldsig#"&gt;&lt;/ds:DigestMethod&gt;
            &lt;ds:DigestValue xmlns:ds="http://www.w3.org/2000/09/xmldsig#"&gt;whvAdAkypsWVXHXbIz/T54n0dBw=&lt;/ds:DigestValue&gt;
          &lt;/ds:Reference&gt;
        &lt;/ds:SignedInfo&gt;
        &lt;ds:SignatureValue&gt;
          MdHy5mceNtQWUD5WmVOzZU8roxD3EQkQmcZA9LsfhBcp3cFAD3P1qJJ9EyrRFBs5yCiYDY716Wzh
          M+tFybt1+EujXZZ3ytk4XaahkexNAG51iup1wvw0Km+nsj4u/x8DzTA/J9EG3ZdTSUrIVBsFcEQa
          TF4BwUAgGBS87xqL5zc=
        &lt;/ds:SignatureValue&gt;
        &lt;ds:KeyInfo Id="KI-B259DAB3D28E48CB6A140000796019095"&gt;
          &lt;wsse:SecurityTokenReference wsu:Id="STR-B259DAB3D28E48CB6A140000796019096" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"&gt;
            &lt;wsse:Reference URI="#X509-B259DAB3D28E48CB6A140000796019094" ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"&gt;&lt;/wsse:Reference&gt;
          &lt;/wsse:SecurityTokenReference&gt;
        &lt;/ds:KeyInfo&gt;
      &lt;/ds:Signature&gt;
      &lt;wsu:Timestamp wsu:Id="TS-94"&gt;
        &lt;wsu:Created xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"&gt;2014-05-13T19:06:00.188Z&lt;/wsu:Created&gt;
        &lt;wsu:Expires xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"&gt;2014-05-13T19:07:00.188Z&lt;/wsu:Expires&gt;
      &lt;/wsu:Timestamp&gt;
    &lt;/wsse:Security&gt;
  &lt;/soapenv:Header&gt;
  </code></pre>
  
  <blockquote>
    <p><strong>This is the one im passing that is not working:</strong></p>
  </blockquote>
  
  <pre><code>&lt;s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" xmlns:u="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"&gt;
    &lt;s:Header&gt;
      &lt;VsDebuggerCausalityData xmlns="http://schemas.microsoft.com/vstudio/diagnostics/servicemodelsink"&gt;uIDPowmum40QT95GqsY7XPKT7LIAAAAAvMwgorinWU+AVOWH+3TPjP6NBU03AZtHqle8GLRYcYAACQAA&lt;/VsDebuggerCausalityData&gt;
      &lt;o:Security s:mustUnderstand="1" xmlns:o="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"&gt;
        &lt;u:Timestamp u:Id="_0"&gt;
          &lt;u:Created&gt;2014-05-15T21:30:20.723Z&lt;/u:Created&gt;
          &lt;u:Expires&gt;2014-05-15T21:35:20.723Z&lt;/u:Expires&gt;
        &lt;/u:Timestamp&gt;
        &lt;o:BinarySecurityToken u:Id="uuid-16d1441d-2f30-40a0-ae4e-ec5d557d2261-2" ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3"&gt;MIIC9jCCAd6gAwIBAgIINNZyZplkQHgwDQYJKoZIhvcNAQEFBQAwNzERMA8GA1UEAwwIQWRtaW5DQTExFTATBgNVBAoMDEVKQkNBIFNhbXBsZTELMAkGA1UEBhMCU0UwHhcNMTQwMzIwMTgzMjQ3WhcNMTgxMjIwMTQzNzEzWjBCMRUwEwYDVQQDDAxjb3Vycmllci5kaGwxDDAKBgNVBAsMA09QUzEOMAwGA1UECgwFREhMUFkxCzAJBgNVBAYTAlBZMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCGoP0dxByIfto/hqJCOhobTdwQJ3AxJkqUeSNFnprAH8zi6HjBJhzkXptqXiR9GZR1H4U3UaN6aczKVh2PaPqU8ooTxjST0ywWBgXA1WP3ukrybUKxpSvqmiRJ/cANAYLovL+gmh2v/fqPiLs7vsgT+zj1330wRGqtrokYPMjlbQIDAQABo38wfTAdBgNVHQ4EFgQU6IHB4XfP7+rbryy1Ru8kFcfSDqcwDAYDVR0TAQH/BAIwADAfBgNVHSMEGDAWgBQxftYTknYINgxTlKH5513cfU8Y3jAOBgNVHQ8BAf8EBAMCBPAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMA0GCSqGSIb3DQEBBQUAA4IBAQB3NQC+0/VmC7A1MStKdc2NctTo7P+mhvIBe54U/Vs8I5vXiatKz01BzHIbl7chjP063V4YTtehDCGkwUTtARqpkua7RfdlMqsmcr1s3qnD4lUpGuAeVW0Wsrhu1xGjPf02fTBdD3yyGWCeUiNvKuoweeATlGyB/VlHJaZHN4HuJCnWlPic6uUUMBYqrOOa+wJr/OCFHqkEiBsUihD6ergj7AeAAFcG41GI2ZjVWK/PEB71sbQqqGgLpigAS9f8PNMm+TnQuizrvLPKm3hanOKYr9ORrbWjZCL3dva1YobK4ykvUYpncj6YsOtuDi62RcHYjT7IF9UoeZHBE2vePc+K&lt;/o:BinarySecurityToken&gt;
        &lt;Signature xmlns="http://www.w3.org/2000/09/xmldsig#"&gt;
          &lt;SignedInfo&gt;
            &lt;CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/&gt;
            &lt;SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/&gt;
            &lt;Reference URI="#_0"&gt;
              &lt;Transforms&gt;
                &lt;Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/&gt;
              &lt;/Transforms&gt;
              &lt;DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/&gt;
              &lt;DigestValue&gt;pM8KraJSLZumo77gD9+JF2f8eBU=&lt;/DigestValue&gt;
            &lt;/Reference&gt;
          &lt;/SignedInfo&gt;
          &lt;SignatureValue&gt;MZ9ZTKeGj5KNUEn4R6cQhRhOdK0frNK1O5KRGbM+YqfvzlVwVKQ6n7p9rncbtrdGsLg3CVwUVwB7PBF78tDx3p0LjF/Eg015t6qouSyK/92qL3oRz/8TbqLKpe/1uySdmGhrqPrVlTDF2rHuFGwmQVSILyUVLg/nW7K+EDwS/Lg=&lt;/SignatureValue&gt;
          &lt;KeyInfo&gt;
            &lt;o:SecurityTokenReference&gt;
              &lt;o:Reference URI="#uuid-16d1441d-2f30-40a0-ae4e-ec5d557d2261-2"/&gt;
            &lt;/o:SecurityTokenReference&gt;
          &lt;/KeyInfo&gt;
        &lt;/Signature&gt;
      &lt;/o:Security&gt;
    &lt;/s:Header&gt; 
  &lt;/s:Envelope&gt;
  </code></pre>