Solved

WS Security - Private Key missing

Posted on 2009-05-07
9
1,052 Views
Last Modified: 2012-05-06
Hi experts,
    I am trying to access a third party web service hosted with Apache server using a VB.Net application through WS Security. I generated a keystore & keypair using java keytool. Using the Public Key, I generated a certificate request and sent it to the CA and they gave me the signed certificate request back to me with the CA certificate. I am using WSE3.0 to create a policy using these certificates and while trying to sign the web service requests, it is giving me back an error saying that the Private key is missing. Can anybody help me on getting around this issue? I am using Visual Studio 2008, WSE 3.0
Thanks & Regards,
Deepu
0
Comment
Question by:deepusreedhar
  • 6
  • 3
9 Comments
 
LVL 31

Expert Comment

by:Paranormastic
Comment Utility
You did not delete the request file before you installed the signed cert, did you?  Deleting the cert (including 'move' command instead of 'copy' to transport it) will typically delete the associated private key.

I would suggest just creating a new one, if it is from your own CA it shouldn't be a big deal and if from a commercial CA - they will typically reissue even with a new CSR within 2 or 4 weeks, depending on vendor.  Just contact their support or sales.

If that doesn't help - what did you use to generate the CSR?  OpenSSL, a windows app, or something else?
0
 
LVL 3

Author Comment

by:deepusreedhar
Comment Utility
Hi Paranormastic,

   Thank you for your reply. I will tell you the steps I followed.
1. I used Java Keytool to generate a keystore & keypair
keytool -genkey -alias mydomain -keyalg RSA -keystore keystore.jks
2. Generated the CSR for that keystore
keytool -certreq -alias mydomain -keystore keystore.jks -file mydomain.csr
3. Sent the CSR to the CA and they gave me back with the signed cert req and the CA cert.
4. I placed the CA cert into the Trusted Root Cert Auth. And the signed cert to the personal keytore of the Local computer so that WSE3.0 tool can find them
5. I changed the web.config file using the WSE3.0 tool by enabling the web service security and created a policy file pointing to these certificates.
6. Part of Web.Config file  given below
7. I am trying to sign the outgoing request with these settings. [Is that just by doing the .SetPolicy to the policy file?] Anyway, The error I am getting says private key is missing. even if I am trying to open the certificate in MMC and try to do a renew cert with same key or if I am opening it in the WSE certificate tool to View Private key file properties it is saying Private key does not exists or not accessible.

Is this makes any sense?
------ Web.Config ----------

<microsoft.web.services3>

    <security>

      <x509 allowTestRoot="true" storeLocation="LocalMachine" />

      <binarySecurityTokenManager>

        <add valueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3" />

      </binarySecurityTokenManager>

    </security>

    <diagnostics>

      <trace enabled="true" input="InputTrace.webinfo" output="OutputTrace.webinfo" />

    </diagnostics>

    <messaging>

      <mtom clientMode="On" />

    </messaging>

    <policy fileName="wse3policyCache.config" />

  </microsoft.web.services3>

----------------------------------------------------------------

Open in new window

0
 
LVL 3

Author Comment

by:deepusreedhar
Comment Utility
            So, as you said. I created a new Private Key and a CSR and sent it to the CA ( This time I used OpenSSL for that). They gave me back a Signed cert Request and the CA certificate. So everything is in one folder now. My folder is now having CA Cert, Signed Cert Request Back from them, My private Key, Original Cert Request. I didn't even import them to the c ertificate store.
             Now can you tell me what should I do? Before I was doing like this. I used to import the signed cert request to the "personal" certificate store of the local computer and the CA certificate to the "Other People" store of the local computer. And using WSE3.0 I am configuring the Web.config file and create the policy file using the certificate policy and pointing the Signed Certificate Request as the Client Certificate and the CA certificate as the Server Certificate.
Any Ideas?
0
 
LVL 3

Author Comment

by:deepusreedhar
Comment Utility
I got around this issue by converting the PEM format certificate to PKCS12 Format certificate by including the Private Key also. So not it is not coming up with the missing private key message, but instead I am getting a different message "WSE101: An asynchronous operation raised an exception. "
"System.ArgumentException: WSE2166: The content type has an incomplete quoted parameter. "
I am including the stacktrace for your reference if anybody can help me out there.
Thanks & Regards,
Deepu
System.ArgumentException: WSE2166: The content type has an incomplete quoted parameter. Server stack trace: at Microsoft.Web.Services3.Mime.ContentTypeParser.ConsumeQuotedString(StringBuilder sb) at Microsoft.Web.Services3.Mime.ContentTypeParser.GetToken() at Microsoft.Web.Services3.Mime.ContentTypeParser..ctor(String s) at Microsoft.Web.Services3.Mime.MtomHelper.IsXopContentType(String contentType) at Microsoft.Web.Services3.Messaging.SoapHttpTransport.IsSupportedContentType(String contentType) at Microsoft.Web.Services3.Messaging.SoapHttpTransport.Send(SoapEnvelope message, EndpointReference destination, SoapHttpChannelOptions options) at Microsoft.Web.Services3.Messaging.SoapHttpOutputChannel.Send(SoapEnvelope message) at System.Runtime.Remoting.Messaging.StackBuilderSink._PrivateProcessMessage(IntPtr md, Object[] args, Object server, Int32 methodPtr, Boolean fExecuteInContext, Object[]& outArgs) at System.Runtime.Remoting.Messaging.StackBuilderSink.PrivateProcessMessage(RuntimeMethodHandle md, Object[] args, Object server, Int32 methodPtr, Boolean fExecuteInContext, Object[]& outArgs) at System.Runtime.Remoting.Messaging.StackBuilderSink.AsyncProcessMessage(IMessage msg, IMessageSink replySink) Exception rethrown at [0]: at System.Runtime.Remoting.Proxies.RealProxy.EndInvokeHelper(Message reqMsg, Boolean bProxyCase) at System.Runtime.Remoting.Proxies.RemotingProxy.Invoke(Object NotUsed, MessageData& msgData) at Microsoft.Web.Services3.Messaging.SoapOutputChannel.SendDelegate.EndInvoke(IAsyncResult result) at Microsoft.Web.Services3.Messaging.SoapOutputChannel.EndSend(IAsyncResult result) at Microsoft.Web.Services3.Messaging.SoapSender.EndSend(IAsyncResult result) at Microsoft.Web.Services3.Messaging.SoapClient.EndSendOneWay(IAsyncResult result) at Microsoft.Web.Services3.Messaging.SoapClient.SoapClientAsyncResult.OnSendComplete(IAsyncResult result)

Open in new window

0
IT, Stop Being Called Into Every Meeting

Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

 
LVL 31

Expert Comment

by:Paranormastic
Comment Utility
If you happen to be running apache AXIS-2 then check to make sure you are at version 1.3.0 or newer:
https://issues.apache.org/jira/browse/AXIS2C-930

Beyond that, I'm not seeing this error documented to be able to say much.

Glad you found the PEM thing for your main issue - sorry I was busy there for a few days and didn't get to post much to follow up.  Many apps like things in PEM - converting to PEM is a good troubleshooting step for most apps whenever you are having difficulty getting a cert to install.
0
 
LVL 3

Author Comment

by:deepusreedhar
Comment Utility
Thank you very much for your reply. As the CA is a third party I don't have any control on the server. I contacted them with the error that I am getting and they came back with a possible helpful point. They were saying my request seems to declare the utf-8 charset twice.

content-id: <0.633784301818437500@example.org>
    content-type:application/xop+xml; charset=utf-8; type="text/xml; charset=utf-8"
    content-transfer-encoding: binary

and the second charset, i.e. utf-8 is being reported back to you in an error message which cannot be parsed by your application because the final quote is assumed to be part of the string on this side.

So now the question becomes how to change that or where to change that to declare it only once?

Regards,
Deepu



content-id: <0.633784301818437500@example.org>

    content-type:application/xop+xml; charset=utf-8; type="text/xml; charset=utf-8"

    content-transfer-encoding: binary

Open in new window

0
 
LVL 31

Expert Comment

by:Paranormastic
Comment Utility
unless you could parse out xop+xml; charset=utf-8 and replace it with xop+xml; I'm not really sure what to say here without seeing more.
0
 
LVL 3

Author Comment

by:deepusreedhar
Comment Utility
How can I replace that? Or where can I change those settings? Is that anything that I can do in the WSE3.0 settings?

0
 
LVL 3

Accepted Solution

by:
deepusreedhar earned 0 total points
Comment Utility
Hi All,
   All the issues sorted with this. I just moved back to Visual Studio 2003, .Net framework 1.1 and WSE 2.0 and it works fine with this. Thanks for all who tried to help me here.
0

Featured Post

Better Security Awareness With Threat Intelligence

See how one of the leading financial services organizations uses Recorded Future as part of a holistic threat intelligence program to promote security awareness and proactively and efficiently identify threats.

Join & Write a Comment

Introduction This article shows how to use the open source plupload control to upload multiple images. The images are resized on the client side before uploading and the upload is done in chunks. Background I had to provide a way for user…
Calculating holidays and working days is a function that is often needed yet it is not one found within the Framework. This article presents one approach to building a working-day calculator for use in .NET.
It is a freely distributed piece of software for such tasks as photo retouching, image composition and image authoring. It works on many operating systems, in many languages.
Polish reports in Access so they look terrific. Take yourself to another level. Equations, Back Color, Alternate Back Color. Write easy VBA Code. Tighten space to use less pages. Launch report from a menu, considering criteria only when it is filled…

772 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

9 Experts available now in Live!

Get 1:1 Help Now