title: Sign WCF message with certificate
body: <p>I am trying to call a third party service. I need to sign my messages with a certificate.</p>
  
  <p>I checked the connectivity using SOAPUI and it works fine. I am now trying to make the call from a WCF client but cannot make it work.
  I'm not familiar with this and may have missed an obvious step.</p>
  
  <p>The configuration generated by svcutil looked like this:</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="utf-8"?&gt;
  &lt;configuration&gt;
    &lt;system.serviceModel&gt;
      &lt;bindings&gt;
        &lt;basicHttpBinding&gt;
          &lt;binding name="ServiceBinding"&gt;
            &lt;security mode="Transport" /&gt;
          &lt;/binding&gt;
        &lt;/basicHttpBinding&gt;
      &lt;/bindings&gt;
      &lt;client&gt;
        &lt;endpoint address="https://url.com" binding="basicHttpBinding"
            bindingConfiguration="ServiceBinding" contract="ServiceContract"
            name="Name" /&gt;
      &lt;/client&gt;
    &lt;/system.serviceModel&gt;
  &lt;/configuration&gt;
  </code></pre>
  
  <p>I added an endpointBehaviour to get the certificate from the store. I also had to change the binding configuration because the signature was not added to the message; I changed the security mode to <code>TransportWithMessageCredentials</code> and set the client credential type of the message to <code>Certificate</code>.
  The modified configuration looks like this (I removed the parts that are not relevant):</p>
  
  <pre><code>&lt;?xml version="1.0"?&gt;
  &lt;configuration&gt;
    &lt;system.serviceModel&gt;
      &lt;bindings&gt;
        &lt;basicHttpBinding&gt;
          &lt;binding name="ServiceBinding"&gt;
            &lt;security mode="TransportWithMessageCredential"&gt;
              &lt;message clientCredentialType="Certificate"/&gt;
            &lt;/security&gt;
          &lt;/binding&gt;
        &lt;/basicHttpBinding&gt;
      &lt;/bindings&gt;
      &lt;client&gt;
        &lt;endpoint address="https://url.com" behaviorConfiguration="Behavior"
          binding="basicHttpBinding" bindingConfiguration="ServiceBinding"
          contract="ServiceContract" name="Name" /&gt;
      &lt;/client&gt;
      &lt;behaviors&gt;
        &lt;endpointBehaviors&gt;
          &lt;behavior name="Behavior"&gt;
            &lt;clientCredentials&gt;
              &lt;clientCertificate storeName="My" x509FindType="FindByThumbprint" findValue="..."/&gt;
            &lt;/clientCredentials&gt;
          &lt;/behavior&gt;
        &lt;/endpointBehaviors&gt;
      &lt;/behaviors&gt;
      &lt;serviceHostingEnvironment aspNetCompatibilityEnabled="true" multipleSiteBindingsEnabled="true" /&gt;
    &lt;/system.serviceModel&gt;
  &lt;/configuration&gt;
  </code></pre>
  
  <p>When I try to make a call, I'm getting the following error:</p>
  
  <blockquote>
    <p>Security processor was unable to find a security header in the
    message. This might be because the message is an unsecured fault or
    because there is a binding mismatch between the communicating parties.
    This can occur if the service is configured for security and the
    client is not using security.</p>
  </blockquote>
  
  <p>I found a few posts regarding this error but none of them could help me.
  I added <code>ProtectionLevel=System.Net.Security.ProtectionLevel.Sign</code>
  to the ServiceContractAttribute as seen in <a href="https://social.msdn.microsoft.com/Forums/vstudio/en-US/667b3e8a-562f-466f-a992-18fdcca3c5ec/wcf-security-processor-was-unable-to-find-a-security-header-in-the-message?forum=wcf" rel="nofollow" title="wcf-security-processor-was-unable-to-find-a-security-header-in-the-message">this post</a>.</p>
  
  <p>Thanks in advance for any help provided.</p>
  
  <p>EDIT:</p>
  
  <p>Upon inspecting the trace logs, I see that the message is sent and that I receive a meaningful response. However, there is no header in the response (which I assume causes the exception). Is there a way I can configure my client to <em>not</em> check for a header in the response?</p>
  
  <p>Trace of request:</p>
  
  <pre><code>&lt;?xml version="1.0"?&gt;
  &lt;E2ETraceEvent xmlns="http://schemas.microsoft.com/2004/06/E2ETraceEvent"&gt;
    &lt;System xmlns="http://schemas.microsoft.com/2004/06/windows/eventlog/system"&gt;
      &lt;EventID&gt;0&lt;/EventID&gt;
      &lt;Type&gt;3&lt;/Type&gt;
      &lt;SubType Name="Information"&gt;0&lt;/SubType&gt;
      &lt;Level&gt;8&lt;/Level&gt;
      &lt;TimeCreated SystemTime="2015-04-21T09:41:19.9227910Z"/&gt;
      &lt;Source Name="System.ServiceModel.MessageLogging"/&gt;
      &lt;Correlation ActivityID="{ba5c25df-1f0a-4375-8b15-e2160e21bc14}"/&gt;
      &lt;Execution ProcessName="w3wp" ProcessID="8540" ThreadID="16"/&gt;
      &lt;Channel/&gt;
      &lt;Computer&gt;PC673&lt;/Computer&gt;
    &lt;/System&gt;
    &lt;ApplicationData&gt;
      &lt;TraceData&gt;
        &lt;DataItem&gt;
          &lt;MessageLogTraceRecord xmlns="http://schemas.microsoft.com/2004/06/ServiceModel/Management/MessageTrace" Time="2015-04-21T11:41:19.9217909+02:00" Source="TransportSend" Type="System.ServiceModel.Security.SecurityAppliedMessage"&gt;
            &lt;Addressing&gt;
              &lt;Action/&gt;
              &lt;To&gt;https://url.com&lt;/To&gt;
            &lt;/Addressing&gt;
            &lt;s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" xmlns:u="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"&gt;
              &lt;s:Header&gt;
                &lt;o:Security xmlns:o="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" s:mustUnderstand="1"&gt;
                  &lt;u:Timestamp u:Id="_0"&gt;
                    &lt;u:Created&gt;2015-04-21T09:41:08.287Z&lt;/u:Created&gt;
                    &lt;u:Expires&gt;2015-04-21T09:46:08.287Z&lt;/u:Expires&gt;
                  &lt;/u:Timestamp&gt;
                  &lt;o:BinarySecurityToken&gt;
                    &lt;!-- Removed--&gt;
                  &lt;/o:BinarySecurityToken&gt;
                  &lt;Signature xmlns="http://www.w3.org/2000/09/xmldsig#"&gt;
                    &lt;SignedInfo&gt;
                      &lt;CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/&gt;
                      &lt;SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/&gt;
                      &lt;Reference URI="#_0"&gt;
                        &lt;Transforms&gt;
                          &lt;Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/&gt;
                        &lt;/Transforms&gt;
                        &lt;DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/&gt;
                        &lt;DigestValue&gt;zvttNRawVVcleH5WAYMCi7oBzpM=&lt;/DigestValue&gt;
                      &lt;/Reference&gt;
                    &lt;/SignedInfo&gt;
                    &lt;SignatureValue&gt;iEMTR/xKruW1TeqJiPdXjNKG3D4ZWyfFM3T+iPy8NSCpwQIpwXmsmrOjT2N5QJoG7S+wyIm2Vsa4rmlmyYBM18rNMeN+luHuUYvNh9ammWyYgam5/mpGBmR8KJiyPSiCxCPeUWuL8z5ag2wGtTrTH/JqOsHfdobnhznvQJgPAc8YWAk6On7SkHT+nKikGv1rEfbCtOBeggbBLLzSArVOBDDOZhWRpRJLhvU6XhlYj1IbgMy4tFP8f0+SESU/UQM+0bBnt0IDwwtTQIyeheifVJINeUHe+T1Pr8qYtyo9/sLulr1vkFe0DAokv1R1WRCU5IoE38I/ptILOMvIq1s3OQ==&lt;/SignatureValue&gt;
                    &lt;KeyInfo&gt;
                      &lt;o:SecurityTokenReference&gt;
                        &lt;o:Reference ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3" URI="#uuid-bda377d4-237a-46b7-a7c3-b7d47578c278-1"/&gt;
                      &lt;/o:SecurityTokenReference&gt;
                    &lt;/KeyInfo&gt;
                  &lt;/Signature&gt;
                &lt;/o:Security&gt;
              &lt;/s:Header&gt;
              &lt;s:Body xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"&gt;
                &lt;!-- Valid request --&gt;
              &lt;/s:Body&gt;
            &lt;/s:Envelope&gt;
          &lt;/MessageLogTraceRecord&gt;
        &lt;/DataItem&gt;
      &lt;/TraceData&gt;
    &lt;/ApplicationData&gt;
  &lt;/E2ETraceEvent&gt;
  </code></pre>
  
  <p>Trace of response:</p>
  
  <pre><code>&lt;?xml version="1.0"?&gt;
  &lt;E2ETraceEvent xmlns="http://schemas.microsoft.com/2004/06/E2ETraceEvent"&gt;
    &lt;System xmlns="http://schemas.microsoft.com/2004/06/windows/eventlog/system"&gt;
      &lt;EventID&gt;0&lt;/EventID&gt;
      &lt;Type&gt;3&lt;/Type&gt;
      &lt;SubType Name="Information"&gt;0&lt;/SubType&gt;
      &lt;Level&gt;8&lt;/Level&gt;
      &lt;TimeCreated SystemTime="2015-04-21T09:41:22.4049329Z"/&gt;
      &lt;Source Name="System.ServiceModel.MessageLogging"/&gt;
      &lt;Correlation ActivityID="{ba5c25df-1f0a-4375-8b15-e2160e21bc14}"/&gt;
      &lt;Execution ProcessName="w3wp" ProcessID="8540" ThreadID="16"/&gt;
      &lt;Channel/&gt;
      &lt;Computer&gt;PC673&lt;/Computer&gt;
    &lt;/System&gt;
    &lt;ApplicationData&gt;
      &lt;TraceData&gt;
        &lt;DataItem&gt;
          &lt;MessageLogTraceRecord xmlns="http://schemas.microsoft.com/2004/06/ServiceModel/Management/MessageTrace" Time="2015-04-21T11:41:22.4049329+02:00" Source="TransportReceive" Type="System.ServiceModel.Channels.BufferedMessage"&gt;
            &lt;HttpResponse&gt;
              &lt;StatusCode&gt;OK&lt;/StatusCode&gt;
              &lt;StatusDescription&gt;OK&lt;/StatusDescription&gt;
              &lt;WebHeaders&gt;
                &lt;X-Backside-Transport&gt;OK OK&lt;/X-Backside-Transport&gt;
                &lt;Connection&gt;Keep-Alive&lt;/Connection&gt;
                &lt;Transfer-Encoding&gt;chunked&lt;/Transfer-Encoding&gt;
                &lt;X-Client-IP&gt;194.78.45.187&lt;/X-Client-IP&gt;
                &lt;Content-Type&gt;text/xml&lt;/Content-Type&gt;
                &lt;Date&gt;Tue, 21 Apr 2015 09:41:11 GMT&lt;/Date&gt;
                &lt;Server&gt;Apache-Coyote/1.1&lt;/Server&gt;
              &lt;/WebHeaders&gt;
            &lt;/HttpResponse&gt;
            &lt;Envelope xmlns="http://schemas.xmlsoap.org/soap/envelope/"&gt;
              &lt;s:Header xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"/&gt;
              &lt;Body&gt;
                &lt;!-- Meaningful response - the same I get when using SOAPUI --&gt;
              &lt;/Body&gt;
            &lt;/Envelope&gt;
          &lt;/MessageLogTraceRecord&gt;
        &lt;/DataItem&gt;
      &lt;/TraceData&gt;
    &lt;/ApplicationData&gt;
  &lt;/E2ETraceEvent&gt;
  </code></pre>