title: Soap body is not encrypted when X509 security implemented on WCF service
body: <p>I implemented a WCF service and a client application for one of projects for my employer and currently facing a serious problem due to the soap body element. The issue is the soap body is not getting encrypted and only the header is encrypted. Anyway the soap request, webconfigs and the way how I created the certificates are mentioned for your reference...</p>
  
  <p>WCF server config
  ......................</p>
  
  
  
  <p> </p>
  
  <pre><code>&lt;bindings&gt;
    &lt;wsHttpBinding&gt;
      &lt;binding name="wsHttpEndpointBinding" &gt;
        &lt;security&gt;
          &lt;message clientCredentialType="Certificate" establishSecurityContext ="true"  /&gt;
        &lt;/security&gt;
      &lt;/binding&gt;
    &lt;/wsHttpBinding&gt;
    &lt;customBinding&gt;
      &lt;binding name="CustomBinding"&gt;        
        &lt;textMessageEncoding messageVersion="Soap11" /&gt;
        &lt;security authenticationMode="MutualCertificate"  requireDerivedKeys="false"
        includeTimestamp="true" keyEntropyMode="ClientEntropy" messageProtectionOrder="EncryptBeforeSign"        messageSecurityVersion="WSSecurity10WSTrustFebruary2005WSSecureConversationFebruary2005WSSecurityPolicy11BasicSecurityProfile10"
        requireSecurityContextCancellation="false"&gt;            
          &lt;secureConversationBootstrap /&gt;
  
        &lt;/security&gt;
        &lt;httpTransport /&gt;
  
      &lt;/binding&gt;
    &lt;/customBinding&gt;
  &lt;/bindings&gt;
  &lt;services&gt;
    &lt;service name="mysvc.MySvc" behaviorConfiguration="mysvc.Service1Behavior"&gt;
      &lt;endpoint address="" binding="customBinding" bindingConfiguration ="CustomBinding"  contract="mysvc.IMySvc"  /&gt;        
      &lt;endpoint address="mex" binding="mexHttpBinding" contract="IMetadataExchange"/&gt;
       &lt;host&gt;
          &lt;baseAddresses&gt;
               &lt;add baseAddress ="http://localhost:8888/" /&gt;
          &lt;/baseAddresses&gt;
       &lt;/host&gt;
    &lt;/service&gt;
  &lt;/services&gt;
  &lt;behaviors&gt;
    &lt;endpointBehaviors&gt;
      &lt;behavior name="inspectorBehavior"&gt;
         &lt;consoleOutputBehavior /&gt;
      &lt;/behavior&gt;
    &lt;/endpointBehaviors&gt;
  
    &lt;serviceBehaviors&gt;
      &lt;behavior name="mysvc.Service1Behavior"&gt;
        &lt;serviceMetadata httpGetEnabled="true"/&gt;
        &lt;serviceDebug includeExceptionDetailInFaults="false"/&gt;
  
        &lt;serviceCredentials&gt;
  
          &lt;serviceCertificate findValue="WCfServerCert"
          storeLocation="LocalMachine" 
          storeName="My"
          x509FindType="FindBySubjectName" /&gt;
  
          &lt;clientCertificate&gt;              
            &lt;authentication certificateValidationMode="None" /&gt;                       
          &lt;/clientCertificate&gt;
  
        &lt;/serviceCredentials&gt;
  
      &lt;/behavior&gt;
    &lt;/serviceBehaviors&gt;
  &lt;/behaviors&gt;  
  </code></pre>
  
  <p>
  </p>
  
  <p>WCF client config
  .....................</p>
  
  <p>
  </p>
  
  <pre><code>&lt;system.serviceModel&gt;
      &lt;bindings&gt;
          &lt;customBinding&gt;
              &lt;binding name="CustomBinding_IMySvc"&gt;
                  &lt;security defaultAlgorithmSuite="Default" authenticationMode="MutualCertificate"
                      requireDerivedKeys="false" securityHeaderLayout="Strict" includeTimestamp="true"
                      keyEntropyMode="ClientEntropy" messageProtectionOrder="EncryptBeforeSign"
                      messageSecurityVersion="WSSecurity10WSTrustFebruary2005WSSecureConversationFebruary2005WSSecurityPolicy11BasicSecurityProfile10"
                      requireSignatureConfirmation="false"&gt;
                      &lt;localClientSettings cacheCookies="true" detectReplays="true"
                          replayCacheSize="900000" maxClockSkew="00:05:00" maxCookieCachingTime="Infinite"
                          replayWindow="00:05:00" sessionKeyRenewalInterval="10:00:00"
                          sessionKeyRolloverInterval="00:05:00" reconnectTransportOnFailure="true"
                          timestampValidityDuration="00:05:00" cookieRenewalThresholdPercentage="60" /&gt;
                      &lt;localServiceSettings detectReplays="true" issuedCookieLifetime="10:00:00"
                          maxStatefulNegotiations="128" replayCacheSize="900000" maxClockSkew="00:05:00"
                          negotiationTimeout="00:01:00" replayWindow="00:05:00" inactivityTimeout="00:02:00"
                          sessionKeyRenewalInterval="15:00:00" sessionKeyRolloverInterval="00:05:00"
                          reconnectTransportOnFailure="true" maxPendingSessions="128"
                          maxCachedCookies="1000" timestampValidityDuration="00:05:00" /&gt;
                      &lt;secureConversationBootstrap /&gt;
                  &lt;/security&gt;
                  &lt;textMessageEncoding maxReadPoolSize="64" maxWritePoolSize="16"
                      messageVersion="Soap11" writeEncoding="utf-8"&gt;
                      &lt;readerQuotas maxDepth="32" maxStringContentLength="8192" maxArrayLength="16384"
                          maxBytesPerRead="4096" maxNameTableCharCount="16384" /&gt;
                  &lt;/textMessageEncoding&gt;
                  &lt;httpTransport manualAddressing="false" maxBufferPoolSize="524288"
                      maxReceivedMessageSize="65536" allowCookies="false" authenticationScheme="Anonymous"
                      bypassProxyOnLocal="false" hostNameComparisonMode="StrongWildcard"
                      keepAliveEnabled="true" maxBufferSize="65536" proxyAuthenticationScheme="Anonymous"
                      realm="" transferMode="Buffered" unsafeConnectionNtlmAuthentication="false"
                      useDefaultWebProxy="true" /&gt;
              &lt;/binding&gt;
          &lt;/customBinding&gt;
      &lt;/bindings&gt;
      &lt;client&gt;
        &lt;endpoint address="http://localhost:8888/" binding="customBinding" behaviorConfiguration ="CustomBehavior"
            bindingConfiguration="CustomBinding_IMySvc" contract="WCFProxy.IMySvc"
            name="CustomBinding_IMySvc" &gt;
  
          &lt;identity &gt;
            &lt;dns value ="WCfServerCert"/&gt;
          &lt;/identity&gt;
  
        &lt;/endpoint&gt;
      &lt;/client&gt;
    &lt;behaviors&gt;
      &lt;endpointBehaviors&gt;
        &lt;behavior name="CustomBehavior"&gt;
          &lt;clientCredentials&gt;
            &lt;clientCertificate findValue="WCfClientCert" x509FindType="FindBySubjectName" storeLocation="LocalMachine" storeName="My" /&gt;
            &lt;serviceCertificate&gt;
              &lt;defaultCertificate findValue="WCfServerCert" x509FindType="FindBySubjectName" storeLocation="LocalMachine" storeName="My" /&gt;
              &lt;authentication certificateValidationMode="None"/&gt;
            &lt;/serviceCertificate&gt;
          &lt;/clientCredentials&gt;
        &lt;/behavior&gt;
      &lt;/endpointBehaviors&gt;
    &lt;/behaviors &gt;
  &lt;/system.serviceModel&gt;
  </code></pre>
  
  <p></p>
  
  <p>CERTIFICATE creation commands
  ...............................</p>
  
  <p>makecert -n "CN=WCFServer" -r -sv WCFServer.pvk WCFServer.cer  </p>
  
  <p>makecert -n "CN=WCFClient" -r -sv WCFClient.pvk WCFClient.cer</p>
  
  <p>makecert -sk WCFServerCert -iv d:\WCFServer.pvk -n "CN=WCFServerCert " -ic d:\WCFServer.cer -sr LocalMachine -ss My -sky exchange pe </p>
  
  <p>makecert -sk WCFClientCert -iv d:\WCFClient.pvk -n "CN=WCFClientCert " -ic d:\WCFClient.cer -sr LocalMachine -ss My -sky exchange pe </p>