BTS 2013 - The message has a bad message signature

Question

I've a problem with BizTalk Server 2013 and a WCF Service. BizTalk needs to consume the WCF Service. BizTalk needs to sign the message with a X509 certificate and I receive the following error message:

There was a failure executing the send pipeline: "BizTalkUtilities.SignPipeline, 
BizTalkUtilities, Version=1.0.0.0, Culture=neutral, PublicKeyToken=d749e81ab815db56" Source: 
"MIME/SMIME encoder" Send Port: "SndPort_Sign_V2" URI: "http://XXXX/DemoServiceSigned
/DemoService.svc" Reason: The message has a bad message signature.  

First I've created the service without security, everything works. Once I've setup my security (message security, Sign) it didn't work anymore. To be sure my service was fine, I've created a test WCF client which consumes the service with the security - no problem.

The message needs to be signed using a X509 certificate. All the certificates are in the correct place. I followed the info stated on MSDN.

Service config:

<bindings>
  <wsHttpBinding>
    <binding name="clientSignConfig">
      <security mode="Message">
        <message clientCredentialType="Certificate"/>
      </security>
    </binding>
  </wsHttpBinding>
</bindings>

<services>
  <service name="SignServiceBL.DemoService" behaviorConfiguration="DemoServiceBehavior">
    <endpoint address=""
              binding="wsHttpBinding"
              bindingConfiguration="clientSignConfig"
              contract="SignServiceBL.IDemoService" />
    <endpoint address="mex" binding="mexHttpBinding" contract="IMetadataExchange" />
  </service>
</services>

<behaviors>
  <serviceBehaviors>
    <behavior name="DemoServiceBehavior">
      <serviceMetadata httpGetEnabled="true"/>
      <serviceDebug includeExceptionDetailInFaults="true"/>
      <serviceCredentials>
        <clientCertificate>
          <authentication certificateValidationMode="PeerTrust" trustedStoreLocation="LocalMachine"/>
        </clientCertificate>
        <serviceCertificate findValue="CN=DemoServiceServerCertificate"/>
      </serviceCredentials>
    </behavior>
  </serviceBehaviors>
</behaviors>

Client config (this works for a WCF Client, but doesn't work in BizTalk)

<bindings>
  <customBinding>
    <binding name="demoService_CustomBinding">
      <transactionFlow />
      <security authenticationMode="SecureConversation" messageSecurityVersion="WSSecurity11WSTrustFebruary2005WSSecureConversationFebruary2005WSSecurityPolicy11BasicSecurityProfile10">
        <secureConversationBootstrap authenticationMode="MutualSslNegotiated" messageSecurityVersion="WSSecurity11WSTrustFebruary2005WSSecureConversationFebruary2005WSSecurityPolicy11BasicSecurityProfile10" />
      </security>
      <textMessageEncoding />
      <httpTransport />
    </binding>
  </customBinding>

</bindings>

<behaviors>
  <endpointBehaviors>
    <behavior name="signingBehavior">
      <clientCredentials>
        <clientCertificate findValue="CN=DemoServiceSigning"
                           storeLocation="CurrentUser" storeName="My"/>
        <serviceCertificate>
          <authentication certificateValidationMode="PeerTrust" trustedStoreLocation="LocalMachine"/>
        </serviceCertificate>
      </clientCredentials>
    </behavior>
  </endpointBehaviors>
</behaviors>

<client>
  <endpoint address="http://XXXX/DemoServiceSigned/DemoService.svc"
      binding="customBinding" bindingConfiguration="demoService_CustomBinding" behaviorConfiguration="signingBehavior"
      contract="DemoService.IDemoService" name="WSHttpBinding_IDemoService">
    <identity>
      <dns value="DemoServiceServerCertificate"/>
    </identity>
  </endpoint>
</client>

I've setup tracing, but BizTalk isn't even sending a message to my service. It's like the sendpipeline is blocking my request.

Any ideas?

EDIT

You don't need the pipeline with a MIME/SMIME encoder to sign WCF messages. You should use this pipeline if you need to sign emails... See the first sentence of MSDN

BizTalk Server supports signing outbound messages and signature verification for inbound Secure Multipurpose Internet Mail Extensions (S/MIME) messages

Once I remove the pipeline, BizTalk sends a message to the service. The problem now is that it's signed and encrypted. I am figuring out how to tell BizTalk to only sign the message. If you have any ideas, feel free to post them. If I find it, I will post it ;-)

Answer 1

It wasn't easy, but I was able to solve my issue :-)

I wrote a blogpost about it, because it's a bit to complicated to create an answer here. So check it out!