how to add encryption to soap header using a username token profile in wcf

Question

I have a working USername token profile working using WCF, I am trying to add support for encryption on the client call, the webservice is expecting an encrypted soap header. I installed a certificate in my Local store using MMC. In my c# code below I have code that loads the certificate and assigns it to the proxy. I am not sure what other settings i need in my custombindings or what am i missing in my c# code. Any suggestions?

app.config:

<customBinding>
<binding name="cbinding">
  <security authenticationMode="UserNameOverTransport" includeTimestamp="false">
    <secureConversationBootstrap  />

  </security>

  <textMessageEncoding  messageVersion="Soap11" />
  <httpsTransport />
</binding>

<endpoint address="https://localhost:8443/p6ws/services/ProjectService?wsdl"
  binding="customBinding" bindingConfiguration="cbinding" contract="P6.WCF.Project.ProjectPortType"
  name="ProjectServiceEndPointCfg">
 </endpoint>

My C# code:

        ProjectPortTypeClient proxy = new ProjectPortTypeClient("ProjectServiceCertificateEndPointCfgUT", endpointAddress);
        proxy.ClientCredentials.UserName.UserName = UserName;
        proxy.ClientCredentials.UserName.Password= Password;

        proxy.ClientCredentials.ServiceCertificate.Authentication.CertificateValidationMode = X509CertificateValidationMode.PeerOrChainTrust;
        proxy.ClientCredentials.ServiceCertificate.Authentication.TrustedStoreLocation = System.Security.Cryptography.X509Certificates.StoreLocation.LocalMachine;

        // Set the certificate
        proxy.ClientCredentials.ClientCertificate.SetCertificate(StoreLocation.CurrentUser, StoreName.My, X509FindType.FindByThumbprint, "13 d3 6e f1 26 5e 5f 74 be f2 bb f5 57 a4 47 cf e7 1a c6 0a");
        proxy.ClientCredentials.ServiceCertificate.SetDefaultCertificate(StoreLocation.CurrentUser, StoreName.My, X509FindType.FindByThumbprint, "13 d3 6e f1 26 5e 5f 74 be f2 bb f5 57 a4 47 cf e7 1a c6 0a");

        ReadProjects readProjects = new ReadProjects();

Answer 1

Although soap requests can be encrypted, you are better off using HTTPS. HTTPS is easier to implement and more secure because it protects the entire transport layer.