title: WCF SOAP 1.1 and WS-Security 1.0, client certificate transport auth, service cert for message body signature, UsernameToken, Password Digest, Nonce
body: <p><strong>Summary:</strong>
  I am working on a .NET 4.0 WCF client to consume a web service (DataPower, Java service on the other end) using SOAP 1.1 and WS-Security 1.0. The WCF client must implement a client certificate for mutual authentication at the transport layer. The message body needs to be signed using a separate service/signing certificate. The SOAP header also needs to contain a Username Token with Password Digest and include Nonce and Created tags.</p>
  
  <p>I am able to consume this web service using WSE 3.0 with BasicHTTPBinding. But I have not been successful so far in implementing the same with WCF using either WSHttpBinding or CustomBinding. I’ve tried all of the security binding elements and have had no luck so far.</p>
  
  <p>I am also using the usernametoken library from here (<a href="http://blogs.msdn.com/b/aszego/archive/2010/06/24/usernametoken-profile-vs-wcf.aspx">http://blogs.msdn.com/b/aszego/archive/2010/06/24/usernametoken-profile-vs-wcf.aspx</a>) so I can add password digest/nonce/created in the UsernameToken in SOAP header.</p>
  
  <p>I am currently using SecurityBindingElement.CreateMutualCertificateBindingElement I’ve also tried several others such as AsymmetricSecurityBindingElement, TransportSecurityBindingElement etc (commented out in code below)</p>
  
  <p><strong>CERTS:</strong>
  I have both the client certificate and service certificate loaded into the certificate store using MMC (I am on Windows 7 btw.) Both the client cert and the service cert have private keys. I’ve loaded both the PFX files into LocalMachine/Personal, LocalMachine/Root and LocalMachine/TrustedPeople. I have also run the FindPrivateKey/ICACLS to give permission to “IIS App Pool/DefaultAppPool” account. Although none of this should matter since I can run the WSE 3.0 code from my machine and it works without any cert issues.</p>
  
  <p><em>Commands run:</em></p>
  
  <pre><code>FindPrivateKey.exe My LocalMachine -t "thumbprint of client cert"
  FindPrivateKey.exe My LocalMachine -t "thumbprint of service cert"
  icacls C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{privateKeyOfClientCert} /grant "IIS AppPool\DefaultAppPool":R      &lt;&lt;Successfully processed 1 files; Failed processing 0 files&gt;&gt;
  icacls C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{privateKeyOfServiceCert} /grant "IIS AppPool\DefaultAppPool":R     &lt;&lt;Successfully processed 1 files; Failed processing 0 files&gt;&gt;
  </code></pre>
  
  <p><strong>WCF ISSUE:</strong>
  I currently receive a “Could not establish secure channel for SSL/TLS with authority 'x.x.com'” message back from the DataPower gateway. I figure this might be because the gateway is taking the service certificate and using that for client authenticate instead of using the client certificate I am sending. I am saying this because when I do not specify the DNS Identity for the endpoint, I get back a message saying that the gateway is expecting the DNS identity to be “{subject name of service/signing certificate}”.</p>
  
  <p>Here is the SOAP request generated by WCF which is giving the above error. The WCF SOAP request looks very similar to the WSE SOAP request. The above error is most probably occurring due to the cert issue at the SSL/Transport layer.</p>
  
  <p><em><strong>WCF SOAP request:</em></strong></p>
  
  <pre><code>&lt;s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" xmlns:u="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"&gt;
  &lt;s:Header&gt;
      &lt;o:Security s:mustUnderstand="1" xmlns:o="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"&gt;
          &lt;u:Timestamp u:Id="uuid-8533d9a5-865e-4a4b-a750-fadb7c1ce36c-1"&gt;
              &lt;u:Created&gt;2013-02-06T20:53:04.679Z&lt;/u:Created&gt;
              &lt;u:Expires&gt;2013-02-06T20:58:04.679Z&lt;/u:Expires&gt;
          &lt;/u:Timestamp&gt;
          &lt;o:BinarySecurityToken u:Id="uuid-0bab08ce-3e3b-4360-a44b-694b06a3dd67-2" ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3"&gt;Removed Service Cert Encoded Value&lt;/o:BinarySecurityToken&gt;
          &lt;wsse:UsernameToken wsu:Id="7843ab92-f69a-4d00-a5ba-117e32a74f49" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"
                              xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"&gt;
              &lt;wsse:Username&gt;USER_Removed&lt;/wsse:Username&gt;
              &lt;wsse:Password Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordDigest"&gt;XXX=&lt;/wsse:Password&gt;
              &lt;wsse:Nonce&gt;XXX==&lt;/wsse:Nonce&gt;
              &lt;wsu:Created&gt;2013-02-06T20:53:04Z&lt;/wsu:Created&gt;
          &lt;/wsse:UsernameToken&gt;
          &lt;Signature xmlns="http://www.w3.org/2000/09/xmldsig#"&gt;
              &lt;SignedInfo&gt;
                  &lt;CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"&gt;&lt;/CanonicalizationMethod&gt;
                  &lt;SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"&gt;&lt;/SignatureMethod&gt;
                  &lt;Reference URI="#_1"&gt;
                      &lt;Transforms&gt;
                          &lt;Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"&gt;&lt;/Transform&gt;
                      &lt;/Transforms&gt;
                      &lt;DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"&gt;&lt;/DigestMethod&gt;
                      &lt;DigestValue&gt;XXX=&lt;/DigestValue&gt;
                  &lt;/Reference&gt;
                  &lt;Reference URI="#uuid-8533d9a5-865e-4a4b-a750-fadb7c1ce36c-1"&gt;
                      &lt;Transforms&gt;
                          &lt;Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"&gt;&lt;/Transform&gt;
                      &lt;/Transforms&gt;
                      &lt;DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"&gt;&lt;/DigestMethod&gt;
                      &lt;DigestValue&gt;XXX=&lt;/DigestValue&gt;
                  &lt;/Reference&gt;
                  &lt;Reference URI="#7843ab92-f69a-4d00-a5ba-117e32a74f49"&gt;
                      &lt;Transforms&gt;
                          &lt;Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"&gt;&lt;/Transform&gt;
                      &lt;/Transforms&gt;
                      &lt;DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"&gt;&lt;/DigestMethod&gt;
                      &lt;DigestValue&gt;XXX=&lt;/DigestValue&gt;
                  &lt;/Reference&gt;
              &lt;/SignedInfo&gt;
              &lt;SignatureValue&gt;XXXLongXXX=&lt;/SignatureValue&gt;
              &lt;KeyInfo&gt;
                  &lt;o:SecurityTokenReference&gt;
                      &lt;o:Reference URI="#uuid-0bab08ce-3e3b-4360-a44b-694b06a3dd67-2"&gt;&lt;/o:Reference&gt;
                  &lt;/o:SecurityTokenReference&gt;
              &lt;/KeyInfo&gt;
          &lt;/Signature&gt;
      &lt;/o:Security&gt;
  &lt;/s:Header&gt;
  &lt;s:Body u:Id="_1" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"&gt;
      &lt;ping xmlns="https://x.x.com/xxx/v1"&gt;
          &lt;pingRequest xmlns=""&gt;hello&lt;/pingRequest&gt;
      &lt;/ping&gt;
  &lt;/s:Body&gt;
  </code></pre>
  
  <p> </p>
  
  <p><em><strong>WSE 3.0 SOAP request (this works):</em></strong></p>
  
  <pre><code>&lt;soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:wsa="http://schemas.xmlsoap.org/ws/2004/08/addressing"
             xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"&gt;
  &lt;soap:Header&gt;
      &lt;wsa:Action wsu:Id="Id-4271fb72-464a-467d-ab1f-4d32542e20f0"/&gt;
      &lt;wsa:MessageID wsu:Id="Id-11657f64-d856-47d8-b600-d5379fb91a0d"&gt;urn:uuid:ff8becb7-74c2-4844-ab46-8ae23f1355a7&lt;/wsa:MessageID&gt;
      &lt;wsa:ReplyTo wsu:Id="Id-40b2e6e8-e67b-4a6c-a545-071ce0f0107a"&gt;
          &lt;wsa:Address&gt;http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous&lt;/wsa:Address&gt;
      &lt;/wsa:ReplyTo&gt;
      &lt;wsa:To wsu:Id="Id-d5e0b488-6f8a-479c-940d-2b85833dbc66"&gt;https://x.x.com/xxx/v1&lt;/wsa:To&gt;
      &lt;wsse:Security soap:mustUnderstand="1"&gt;
          &lt;wsu:Timestamp wsu:Id="Timestamp-68476551-5c58-4a47-967b-54ec18257b1b"&gt;
              &lt;wsu:Created&gt;2013-02-06T19:38:39Z&lt;/wsu:Created&gt;
              &lt;wsu:Expires&gt;2013-02-06T19:43:39Z&lt;/wsu:Expires&gt;
          &lt;/wsu:Timestamp&gt;
          &lt;wsse:UsernameToken wsu:Id="SecurityToken-e5f65166-a825-48cb-a939-8e515a637e01"&gt;
              &lt;wsse:Username&gt;USER_Removed&lt;/wsse:Username&gt;
              &lt;wsse:Password Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordDigest"&gt;XXX=&lt;/wsse:Password&gt;
              &lt;wsse:Nonce&gt;XXX==&lt;/wsse:Nonce&gt;
              &lt;wsu:Created&gt;2013-02-06T19:38:39Z&lt;/wsu:Created&gt;
          &lt;/wsse:UsernameToken&gt;
          &lt;Signature xmlns="http://www.w3.org/2000/09/xmldsig#"&gt;
              &lt;SignedInfo&gt;
                  &lt;ds:CanonicalizationMethod xmlns:ds="http://www.w3.org/2000/09/xmldsig#" Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/&gt;
                  &lt;SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/&gt;
                  &lt;Reference URI="#Id-4271fb72-464a-467d-ab1f-4d32542e20f0"&gt;
                      &lt;Transforms&gt;
                          &lt;Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/&gt;
                      &lt;/Transforms&gt;
                      &lt;DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/&gt;
                      &lt;DigestValue&gt;XXX=&lt;/DigestValue&gt;
                  &lt;/Reference&gt;
                  &lt;Reference URI="#Id-11657f64-d856-47d8-b600-d5379fb91a0d"&gt;
                      &lt;Transforms&gt;
                          &lt;Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/&gt;
                      &lt;/Transforms&gt;
                      &lt;DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/&gt;
                      &lt;DigestValue&gt;XXX=&lt;/DigestValue&gt;
                  &lt;/Reference&gt;
                  &lt;Reference URI="#Id-40b2e6e8-e67b-4a6c-a545-071ce0f0107a"&gt;
                      &lt;Transforms&gt;
                          &lt;Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/&gt;
                      &lt;/Transforms&gt;
                      &lt;DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/&gt;
                      &lt;DigestValue&gt;XXX=&lt;/DigestValue&gt;
                  &lt;/Reference&gt;
                  &lt;Reference URI="#Id-d5e0b488-6f8a-479c-940d-2b85833dbc66"&gt;
                      &lt;Transforms&gt;
                          &lt;Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/&gt;
                      &lt;/Transforms&gt;
                      &lt;DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/&gt;
                      &lt;DigestValue&gt;XXX=&lt;/DigestValue&gt;
                  &lt;/Reference&gt;
                  &lt;Reference URI="#Timestamp-68476551-5c58-4a47-967b-54ec18257b1b"&gt;
                      &lt;Transforms&gt;
                          &lt;Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/&gt;
                      &lt;/Transforms&gt;
                      &lt;DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/&gt;
                      &lt;DigestValue&gt;XXX=&lt;/DigestValue&gt;
                  &lt;/Reference&gt;
                  &lt;Reference URI="#Id-6f76e50e-932c-4878-bbc0-3ef4c8a36990"&gt;
                      &lt;Transforms&gt;
                          &lt;Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/&gt;
                      &lt;/Transforms&gt;
                      &lt;DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/&gt;
                      &lt;DigestValue&gt;XXX=&lt;/DigestValue&gt;
                  &lt;/Reference&gt;
              &lt;/SignedInfo&gt;
              &lt;SignatureValue&gt;XXXLongXXX=&lt;/SignatureValue&gt;
              &lt;KeyInfo&gt;
                  &lt;wsse:SecurityTokenReference&gt;
                      &lt;wsse:KeyIdentifier ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentifier"
                                          EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary"&gt;XXX=&lt;/wsse:KeyIdentifier&gt;
                  &lt;/wsse:SecurityTokenReference&gt;
              &lt;/KeyInfo&gt;
          &lt;/Signature&gt;
      &lt;/wsse:Security&gt;
  &lt;/soap:Header&gt;
  &lt;soap:Body wsu:Id="Id-6f76e50e-932c-4878-bbc0-3ef4c8a36990"&gt;
      &lt;ping xmlns="https://x.x.com/xxx/v1"&gt;
          &lt;pingRequest xmlns=""&gt;hello&lt;/pingRequest&gt;
      &lt;/ping&gt;
  &lt;/soap:Body&gt;
  </code></pre>
  
  <p> </p>
  
  <p>Here is all of the config, please let me know what I am doing wrong!</p>
  
  <p>WCF web.config: I removed everything from the web.config as I am doing all the config in code.</p>
  
  <p>WCF config in code:</p>
  
  <pre><code>var proxy = GetProxy();
  pingResponseMessage resp = proxy.ping("hello");
  lblStatus.Text = resp.status.ToString();
  
  private XXXClient GetProxy()
  {
  
      System.Net.ServicePointManager.ServerCertificateValidationCallback += (se, cert, chain, sslerror) =&gt; { return true; };
  
      XXXClient proxy = new XXXClient(GetCustomBinding(), new EndpointAddress(new Uri("https://xxx"), EndpointIdentity.CreateDnsIdentity("I am forced to put the signing cert subject here, nothing else works"), new AddressHeaderCollection()));
  
      proxy.Endpoint.Behaviors.Remove(typeof(ClientCredentials));
      proxy.Endpoint.Behaviors.Add(new UsernameClientCredentials(new UsernameInfo(@"USER_Removed", "X")));
  
      proxy.ClientCredentials.ClientCertificate.SetCertificate(StoreLocation.LocalMachine, StoreName.My, X509FindType.FindByThumbprint, "REMOVED");
      proxy.ClientCredentials.ServiceCertificate.SetDefaultCertificate(StoreLocation.LocalMachine, StoreName.My, X509FindType.FindByThumbprint, "REMOVED");
      proxy.ClientCredentials.ServiceCertificate.Authentication.CertificateValidationMode = System.ServiceModel.Security.X509CertificateValidationMode.None;
  
      return proxy;
  }
  
  private Binding GetCustomBinding()
  {
      //TransportSecurityBindingElement secBE = SecurityBindingElement.CreateCertificateOverTransportBindingElement(MessageSecurityVersion.WSSecurity10WSTrust13WSSecureConversation13WSSecurityPolicy12BasicSecurityProfile10);
      //AsymmetricSecurityBindingElement secBE = (AsymmetricSecurityBindingElement)SecurityBindingElement.CreateMutualCertificateBindingElement(MessageSecurityVersion.WSSecurity10WSTrustFebruary2005WSSecureConversationFebruary2005WSSecurityPolicy11BasicSecurityProfile10);
      //secBE.InitiatorTokenParameters = new System.ServiceModel.Security.Tokens.X509SecurityTokenParameters { InclusionMode = SecurityTokenInclusionMode.AlwaysToRecipient, RequireDerivedKeys = false, X509ReferenceStyle = X509KeyIdentifierClauseType.SubjectKeyIdentifier };
      //secBE.RecipientTokenParameters = new System.ServiceModel.Security.Tokens.X509SecurityTokenParameters { InclusionMode = SecurityTokenInclusionMode.AlwaysToInitiator, RequireDerivedKeys = false, X509ReferenceStyle = X509KeyIdentifierClauseType.SubjectKeyIdentifier };
      //secBE.MessageProtectionOrder = System.ServiceModel.Security.MessageProtectionOrder.SignBeforeEncrypt;
      //secBE.EndpointSupportingTokenParameters.Signed.Add(new UserNameSecurityTokenParameters() { InclusionMode = SecurityTokenInclusionMode.AlwaysToRecipient, RequireDerivedKeys = false });
      //secBE.EndpointSupportingTokenParameters.Signed.Add(new X509SecurityTokenParameters(X509KeyIdentifierClauseType.SubjectKeyIdentifier, SecurityTokenInclusionMode.Never) { InclusionMode = SecurityTokenInclusionMode.Never, RequireDerivedKeys = false, X509ReferenceStyle = X509KeyIdentifierClauseType.SubjectKeyIdentifier });
      //secBE.ProtectionTokenParameters = new System.ServiceModel.Security.Tokens.X509SecurityTokenParameters { InclusionMode = SecurityTokenInclusionMode.AlwaysToRecipient };
      //secBE.DefaultAlgorithmSuite = new CustomSecurityAlgorithm();
  
      SecurityBindingElement secBE = SecurityBindingElement.CreateMutualCertificateBindingElement(MessageSecurityVersion.WSSecurity10WSTrustFebruary2005WSSecureConversationFebruary2005WSSecurityPolicy11BasicSecurityProfile10);
      secBE.MessageSecurityVersion = MessageSecurityVersion.WSSecurity10WSTrustFebruary2005WSSecureConversationFebruary2005WSSecurityPolicy11BasicSecurityProfile10;
      secBE.EndpointSupportingTokenParameters.Signed.Add(new UsernameTokenParameters() { InclusionMode= SecurityTokenInclusionMode.AlwaysToRecipient, ReferenceStyle = SecurityTokenReferenceStyle.External, RequireDerivedKeys = false });
      secBE.SecurityHeaderLayout = SecurityHeaderLayout.Strict;
      //secBE.AllowInsecureTransport = false;
      //secBE.AllowSerializedSigningTokenOnReply = false;
      secBE.EnableUnsecuredResponse = true;
     secBE.IncludeTimestamp = true;
      secBE.SetKeyDerivation(false);
  
      TextMessageEncodingBindingElement textEncBE = new TextMessageEncodingBindingElement(MessageVersion.Soap11, System.Text.Encoding.UTF8);
  
      HttpsTransportBindingElement httpsBE = new HttpsTransportBindingElement();
      httpsBE.RequireClientCertificate = true;
      //httpsBindingElement.AllowCookies = false;
      //httpsBindingElement.AuthenticationScheme = System.Net.AuthenticationSchemes.Basic;
      httpsBE.BypassProxyOnLocal = false;
      httpsBE.HostNameComparisonMode = HostNameComparisonMode.StrongWildcard;
      //httpsBindingElement.KeepAliveEnabled = false;
      httpsBE.TransferMode = TransferMode.Buffered;
      httpsBE.UseDefaultWebProxy = true;
  
      CustomBinding myBinding = new CustomBinding();
      myBinding.Elements.Add(secBE);
      myBinding.Elements.Add(textEncBE);
      myBinding.Elements.Add(httpsBE);
  
      return myBinding;
  }
  </code></pre>
  
  <p>I’ve added ProtectionLevel.Sign on the ServiceContract and OperationContracts since I only need to sign the message body. I haven’t gotten this far to verify it yet though.</p>
  
  <pre><code>[System.ServiceModel.ServiceContractAttribute(Namespace = "https://x.x.com/xxx/v1", ConfigurationName = "x.x", ProtectionLevel = System.Net.Security.ProtectionLevel.Sign)]
  public interface XXXService {
      [System.ServiceModel.OperationContractAttribute(Action = "", ReplyAction = "*", ProtectionLevel = System.Net.Security.ProtectionLevel.Sign)]
      [System.ServiceModel.XmlSerializerFormatAttribute(SupportFaults=true)]
      [return: System.ServiceModel.MessageParameterAttribute(Name="return")]
      XXX.pingResponse ping(XXX.ping request);
  
  [System.ServiceModel.ServiceContractAttribute(Namespace = "https://x.x.com/xxx/v1", ProtectionLevel = System.Net.Security.ProtectionLevel.Sign)]
  public partial class XXXClient : System.ServiceModel.ClientBase&lt;XXXService&gt; {
      [System.ServiceModel.OperationContractAttribute(Action = "", ReplyAction = "*", ProtectionLevel = System.Net.Security.ProtectionLevel.Sign)]
      public XXX.pingResponseMessage ping(string pingRequest) {
  </code></pre>
  
  <p>I’ve added the following the below to web.config to allow logging of the entire soap including pii data</p>
  
  <pre><code>(for pii, also added &lt;machineSettings enableLoggingKnownPii="true" /&gt; under &lt;system.serviceModel&gt; to C:\Windows\Microsoft.NET\Framework\vX\CONFIG\machine.config)
  
  &lt;system.serviceModel&gt;
  &lt;diagnostics&gt;
    &lt;messageLogging logKnownPii="true" logEntireMessage="true" logMalformedMessages="true" logMessagesAtServiceLevel="true" logMessagesAtTransportLevel="true" maxMessagesToLog="3000"/&gt;
  &lt;/diagnostics&gt;
  &lt;/system.serviceModel&gt;
  &lt;system.diagnostics&gt;
  &lt;sources&gt;
    &lt;source name="System.ServiceModel.MessageLogging" logKnownPii="true"&gt;
      &lt;listeners&gt;
        &lt;add initializeData="C:\trace.log" type="System.Diagnostics.XmlWriterTraceListener" name="messages"/&gt;
      &lt;/listeners&gt;
    &lt;/source&gt;
  &lt;/sources&gt;
  &lt;/system.diagnostics&gt;
  </code></pre>
  
  <p>===============</p>
  
  <p><em><strong>WSE 3.0 (Working config and code):</em></strong>
  web.config:</p>
  
  <pre><code>&lt;system.serviceModel&gt;
  &lt;bindings&gt;
    &lt;basicHttpBinding&gt;
      &lt;binding name="myBinding" closeTimeout="00:01:00" openTimeout="00:01:00" receiveTimeout="00:10:00" sendTimeout="00:01:00" allowCookies="false" bypassProxyOnLocal="false" hostNameComparisonMode="StrongWildcard" maxBufferSize="65536" maxBufferPoolSize="524288" maxReceivedMessageSize="65536" messageEncoding="Text" textEncoding="utf-8" transferMode="Buffered" useDefaultWebProxy="true"&gt;
        &lt;readerQuotas maxDepth="32" maxStringContentLength="8192" maxArrayLength="16384" maxBytesPerRead="4096" maxNameTableCharCount="16384"/&gt;
        &lt;security mode="Transport"&gt;
          &lt;transport clientCredentialType="None" proxyCredentialType="None" realm=""/&gt;
          &lt;message clientCredentialType="UserName" algorithmSuite="Default"/&gt;
        &lt;/security&gt;
      &lt;/binding&gt;
    &lt;/basicHttpBinding&gt;
  &lt;/bindings&gt;
  &lt;client&gt;
    &lt;endpoint address="https://x.x.com/xxx/v1" binding="basicHttpBinding" bindingConfiguration="myBinding" contract="XXXService" name="XXX"/&gt;
  &lt;/client&gt;
  &lt;/system.serviceModel&gt;
  &lt;appSettings&gt;
  &lt;add key="XXXImplService" value="https://x.x.com/xxx/v1"/&gt;
  &lt;/appSettings&gt;
  </code></pre>
  
  <p>... and WSE3 code:</p>
  
  <pre><code>var proxy = new XXXImplServiceWse();
  
  UsernameToken usernameToken = new UsernameToken(@"USER_Removed", "X");
  proxy.RequestSoapContext.Security.Tokens.Add(usernameToken);
  
  X509Certificate2 mutualCert = LoadCertFromStore(StoreLocation.LocalMachine, StoreName.My, "Client Cert Subject Name");
  proxy.ClientCertificates.Add(mutualCert);
  
  X509Certificate2 signCert = LoadCertFromStore(StoreLocation.LocalMachine, StoreName.My, "Service Cert Subject Name");
  
  X509SecurityToken signatureToken = new X509SecurityToken(signCert);
  
  MessageSignature signature = new MessageSignature(signatureToken); // &lt;!-- IS THIS SAME AS THIS STEP IN WCF: secBE.EndpointSupportingTokenParameters.Signed.Add(new UsernameTokenParameters()) --&gt;
  
  proxy.RequestSoapContext.Security.Elements.Add(signature);
  </code></pre>
  
  <p>==========</p>
  
  <p><strong>So, how do I convert the above WSE 3.0 code to WCF?</strong></p>