title: How to get WS-Security certificate to be accepted by Java application
body: <p>So I've been struggling with WS-Security for some time now, slowly making progress. First let me briefly describe my setup. I have Java application running in a tomcat, which offers a webservice endpoint (using Spring). I want incoming messages to be signed. I am testing with SoapUI. So after a long struggle, I got the server as far as checking incoming messages for a signature and I also got SoapUI, to sign outgoing messages. However, the server keeps rejecting the certificate and I'm not sure where I'm doing something wrong, i.e. am I sending the wrong certificate information with my test requests, or have I not correctly maintained the certificate in the truststore. Following is an example of a request:</p>
  
  <pre><code>&lt;soapenv:Envelope xmlns="http://movilitas.com/movilizer/v7" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"&gt;
     &lt;soapenv:Header&gt;
        &lt;wsse:Security xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"&gt;
           &lt;wsu:Timestamp wsu:Id="Timestamp-7" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"&gt;
              &lt;wsu:Created&gt;2011-06-30T12:51:33.407Z&lt;/wsu:Created&gt;
              &lt;wsu:Expires&gt;2011-06-30T12:53:13.407Z&lt;/wsu:Expires&gt;
           &lt;/wsu:Timestamp&gt;
           &lt;ds:Signature Id="Signature-6" xmlns:ds="http://www.w3.org/2000/09/xmldsig#"&gt;
              &lt;ds:SignedInfo&gt;
                 &lt;ds:CanonicalizationMethod Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315"/&gt;
                 &lt;ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/&gt;
                 &lt;ds:Reference URI="#id-2"&gt;
                    &lt;ds:Transforms&gt;
                       &lt;ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/&gt;
                    &lt;/ds:Transforms&gt;
                    &lt;ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/&gt;
                    &lt;ds:DigestValue&gt;OiRQ2oXbajnnrSGsbOALT2i6brs=&lt;/ds:DigestValue&gt;
                 &lt;/ds:Reference&gt;
              &lt;/ds:SignedInfo&gt;
              &lt;ds:SignatureValue&gt;
                  fmtFMSccFcwEfL1M8qgQ...
              &lt;/ds:SignatureValue&gt;
              &lt;ds:KeyInfo Id="KeyId-C3B38A939F7D63D51F13094382933988"&gt;
                 &lt;wsse:SecurityTokenReference wsu:Id="STRId-C3B38A939F7D63D51F13094382933989" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"&gt;
                    &lt;wsse:KeyIdentifier EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary" 
                                        ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3SubjectKeyIdentifier"&gt;
                          MIICbzCCAdgCAQEwDQ... 
                      &lt;/wsse:KeyIdentifier&gt;
                 &lt;/wsse:SecurityTokenReference&gt;
              &lt;/ds:KeyInfo&gt;
           &lt;/ds:Signature&gt;
        &lt;/wsse:Security&gt;
     &lt;/soapenv:Header&gt;
     &lt;soapenv:Body wsu:Id="id-2" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"&gt;
        [...]
     &lt;/soapenv:Body&gt;
  &lt;/soapenv:Envelope&gt;
  </code></pre>
  
  <p>Now the content I have in  is the same as the one I get, when I export the certificate from my truststore (the base64 encoded version of the certificate). The error I get when I send the request is the following:</p>
  
  <pre><code>Jul 5, 2011 4:42:23 PM com.sun.xml.wss.impl.dsig.KeySelectorImpl resolve
  SEVERE: WSS1353: Error occurred while resolving key information
  com.sun.xml.wss.XWSSecurityException: No Matching public key for MIICbzCCAdgCAQEwDQ... subject key identifier found
      at com.sun.xml.wss.impl.misc.DefaultSecurityEnvironmentImpl.getCertificate(DefaultSecurityEnvironmentImpl.java:617)
      at com.sun.xml.wss.impl.dsig.KeySelectorImpl.resolve(KeySelectorImpl.java:385)
      at com.sun.xml.wss.impl.dsig.KeySelectorImpl.select(KeySelectorImpl.java:232)
      ...
  </code></pre>
  
  <p>Am I missing something? Something big? Or small? Is this what I am actually supposed to send as KeyIdentifier? Any help will be greatly appreciated!    </p>