I have a SOAP server. The soap request that is receiving at the server has ws security headers. Following are the main nodes of the request XML.

  1. BinarySecurityToken (X509PKIPathv1 certificate)
  2. DigestMethod
  3. DigestValue
  4. SignatureValue
  5. SecurityTokenReference

  6. Data (data that is send by client in SOAP body)

I have to verify the request using the certificate(.cer files) which is provided by the client (sender of the request).

What are the steps I have to do to validate the requests? I Googled but no hope. Please help me to understand the concept.

  • 3
    Even if the request is transmitted over TLS, the authentication does not use TLS client-auth. Why do you think this has something to do with TLS and OpenSSL? Look into WS-Security and the library/framework you work with to find out how to validate the request. – Z.T. Oct 16 '15 at 17:40
  • It just completely depends on which SOAP server you are using and your exact use-case. I fear there is no general answer which can be given to this question (moreover development or product configuration requests are most likely out-of-topic here). – WhiteWinterWolf Oct 17 '15 at 11:27