WS Security - Private Key missing

You did not delete the request file before you installed the signed cert, did you?  Deleting the cert (including 'move' command instead of 'copy' to transport it) will typically delete the associated private key.

I would suggest just creating a new one, if it is from your own CA it shouldn't be a big deal and if from a commercial CA - they will typically reissue even with a new CSR within 2 or 4 weeks, depending on vendor.  Just contact their support or sales.

If that doesn't help - what did you use to generate the CSR?  OpenSSL, a windows app, or something else?

Hi Paranormastic,

   Thank you for your reply. I will tell you the steps I followed.
1. I used Java Keytool to generate a keystore & keypair
keytool -genkey -alias mydomain -keyalg RSA -keystore keystore.jks
2. Generated the CSR for that keystore
keytool -certreq -alias mydomain -keystore keystore.jks -file mydomain.csr
3. Sent the CSR to the CA and they gave me back with the signed cert req and the CA cert.
4. I placed the CA cert into the Trusted Root Cert Auth. And the signed cert to the personal keytore of the Local computer so that WSE3.0 tool can find them
5. I changed the web.config file using the WSE3.0 tool by enabling the web service security and created a policy file pointing to these certificates.
6. Part of Web.Config file  given below
7. I am trying to sign the outgoing request with these settings. [Is that just by doing the .SetPolicy to the policy file?] Anyway, The error I am getting says private key is missing. even if I am trying to open the certificate in MMC and try to do a renew cert with same key or if I am opening it in the WSE certificate tool to View Private key file properties it is saying Private key does not exists or not accessible.

Is this makes any sense?

------ Web.Config ----------
<microsoft.web.services3>
    <security>
      <x509 allowTestRoot="true" storeLocation="LocalMachine" />
      <binarySecurityTokenManager>
        <add valueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3" />
      </binarySecurityTokenManager>
    </security>
    <diagnostics>
      <trace enabled="true" input="InputTrace.webinfo" output="OutputTrace.webinfo" />
    </diagnostics>
    <messaging>
      <mtom clientMode="On" />
    </messaging>
    <policy fileName="wse3policyCache.config" />
  </microsoft.web.services3>
----------------------------------------------------------------

Select allOpen in new window

            So, as you said. I created a new Private Key and a CSR and sent it to the CA ( This time I used OpenSSL for that). They gave me back a Signed cert Request and the CA certificate. So everything is in one folder now. My folder is now having CA Cert, Signed Cert Request Back from them, My private Key, Original Cert Request. I didn't even import them to the c ertificate store.
             Now can you tell me what should I do? Before I was doing like this. I used to import the signed cert request to the "personal" certificate store of the local computer and the CA certificate to the "Other People" store of the local computer. And using WSE3.0 I am configuring the Web.config file and create the policy file using the certificate policy and pointing the Signed Certificate Request as the Client Certificate and the CA certificate as the Server Certificate.
Any Ideas?

I got around this issue by converting the PEM format certificate to PKCS12 Format certificate by including the Private Key also. So not it is not coming up with the missing private key message, but instead I am getting a different message "WSE101: An asynchronous operation raised an exception. "
"System.ArgumentException: WSE2166: The content type has an incomplete quoted parameter. "
I am including the stacktrace for your reference if anybody can help me out there.
Thanks & Regards,
Deepu

System.ArgumentException: WSE2166: The content type has an incomplete quoted parameter. Server stack trace: at Microsoft.Web.Services3.Mime.ContentTypeParser.ConsumeQuotedString(StringBuilder sb) at Microsoft.Web.Services3.Mime.ContentTypeParser.GetToken() at Microsoft.Web.Services3.Mime.ContentTypeParser..ctor(String s) at Microsoft.Web.Services3.Mime.MtomHelper.IsXopContentType(String contentType) at Microsoft.Web.Services3.Messaging.SoapHttpTransport.IsSupportedContentType(String contentType) at Microsoft.Web.Services3.Messaging.SoapHttpTransport.Send(SoapEnvelope message, EndpointReference destination, SoapHttpChannelOptions options) at Microsoft.Web.Services3.Messaging.SoapHttpOutputChannel.Send(SoapEnvelope message) at System.Runtime.Remoting.Messaging.StackBuilderSink._PrivateProcessMessage(IntPtr md, Object[] args, Object server, Int32 methodPtr, Boolean fExecuteInContext, Object[]& outArgs) at System.Runtime.Remoting.Messaging.StackBuilderSink.PrivateProcessMessage(RuntimeMethodHandle md, Object[] args, Object server, Int32 methodPtr, Boolean fExecuteInContext, Object[]& outArgs) at System.Runtime.Remoting.Messaging.StackBuilderSink.AsyncProcessMessage(IMessage msg, IMessageSink replySink) Exception rethrown at [0]: at System.Runtime.Remoting.Proxies.RealProxy.EndInvokeHelper(Message reqMsg, Boolean bProxyCase) at System.Runtime.Remoting.Proxies.RemotingProxy.Invoke(Object NotUsed, MessageData& msgData) at Microsoft.Web.Services3.Messaging.SoapOutputChannel.SendDelegate.EndInvoke(IAsyncResult result) at Microsoft.Web.Services3.Messaging.SoapOutputChannel.EndSend(IAsyncResult result) at Microsoft.Web.Services3.Messaging.SoapSender.EndSend(IAsyncResult result) at Microsoft.Web.Services3.Messaging.SoapClient.EndSendOneWay(IAsyncResult result) at Microsoft.Web.Services3.Messaging.SoapClient.SoapClientAsyncResult.OnSendComplete(IAsyncResult result)

Select allOpen in new window

If you happen to be running apache AXIS-2 then check to make sure you are at version 1.3.0 or newer:
https://issues.apache.org/jira/browse/AXIS2C-930

Beyond that, I'm not seeing this error documented to be able to say much.

Glad you found the PEM thing for your main issue - sorry I was busy there for a few days and didn't get to post much to follow up.  Many apps like things in PEM - converting to PEM is a good troubleshooting step for most apps whenever you are having difficulty getting a cert to install.

Thank you very much for your reply. As the CA is a third party I don't have any control on the server. I contacted them with the error that I am getting and they came back with a possible helpful point. They were saying my request seems to declare the utf-8 charset twice.

content-id: <0.633784301818437500@example.org>
    content-type:application/xop+xml; charset=utf-8; type="text/xml; charset=utf-8"
    content-transfer-encoding: binary

and the second charset, i.e. utf-8 is being reported back to you in an error message which cannot be parsed by your application because the final quote is assumed to be part of the string on this side.

So now the question becomes how to change that or where to change that to declare it only once?

Regards,
Deepu

content-id: <0.633784301818437500@example.org>
    content-type:application/xop+xml; charset=utf-8; type="text/xml; charset=utf-8"
    content-transfer-encoding: binary

Select allOpen in new window

unless you could parse out xop+xml; charset=utf-8 and replace it with xop+xml; I'm not really sure what to say here without seeing more.

How can I replace that? Or where can I change those settings? Is that anything that I can do in the WSE3.0 settings?