WSS client fails to validate signature

Question

I try to call a secure X.509 web service with a standalone client. My client is able to call the service, but it fails to validate a signature in the response. Stacktrace:
Exception in thread "main" javax.xml.ws.soap.SOAPFaultException: weblogic.xml.dom.marshal.MarshalException: weblogic.xml.crypto.wss.WSSecurityException: Signature failed to validate.  Reference: #str_nqug2feZarDRqizh does not validate.
     at com.sun.xml.ws.fault.SOAP11Fault.getProtocolException(SOAP11Fault.java:196)
     at com.sun.xml.ws.fault.SOAPFaultBuilder.createException(SOAPFaultBuilder.java:122)
     at com.sun.xml.ws.client.sei.SyncMethodHandler.invoke(SyncMethodHandler.java:119)
     at com.sun.xml.ws.client.sei.SyncMethodHandler.invoke(SyncMethodHandler.java:89)
     at com.sun.xml.ws.client.sei.SEIStub.invoke(SEIStub.java:118)
     at $Proxy29.echoComplexType(Unknown Source)
     at examples.webservices.simple_client.SecureMain2.main(Unknown Source)I deployed my war in WLS 10.3.1 and 10.3.3 with the same result.
My web service class is annotated with
@Policy(uri="policy:Wssp1.2-2007-Wss1.0-X509-Basic256.xml")I managed to get the request and response message from the sysout by setting VM directive
-Dweblogic.wsee.verbose=*I don't know where to go from here. Any help would be very much appreciated! Messages and sources are pasted below.
Request
<?xml version='1.0' encoding='UTF-8'?>
<S:Envelope xmlns:S="http://schemas.xmlsoap.org/soap/envelope/">
     <S:Header>
          <wsse:Security
               xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"
               S:mustUnderstand="1">
               <wsse:BinarySecurityToken
                    xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"
                    xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"
                    EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary"
                    ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3"
                    wsu:Id="bst_Wf9BN8DhNsWFJp0a">MIIEVjCCAz6gAwIBAgIIBLJ8Vn+Q6E4wDQYJKoZIhvcNAQEFBQAwbDELMAkGA1UEBhMCTkwxFjAUBgNVBAgTDU5vb3JkIEhvbGxhbmQxHDAaBgNVBAcTE0x1Y2h0aGF2ZW4gU2NoaXBob2wxDTALBgNVBAoTBEZMVVgxGDAWBgNVBAMTD0ZMVVggTkwgVEVTVCBDQTAeFw0wOTEyMDMxNTI4MDdaFw0xMDEyMDMxNTI4MDdaMIGZMQswCQYDVQQGEwJOTDEWMBQGA1UECBMNTm9vcmQgSG9sbGFuZDEcMBoGA1UEBxMTTHVjaHRoYXZlbiBTY2hpcGhvbDEhMB8GA1UEChMYRkxVWCBMTk0gQkFDS09GRklDRSBURVNUMRwwGgYDVQQDExNMTk0gQmFja29mZmljZSBUZXN0MRMwEQYKCZImiZPyLGQBGRYDbG5tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA2ZsbeLX/1L0tMUnQkv903uEpiWIcrDzyd4IeBUZYGrbhJeU4DDtA2s4eDrs8UvmRyEVDklo45+V0E0nXs7mdKd453LvuCebQIkP9mIW1IWmfY7JzV2ZsGQuc2agaz6Sv9r+hsGScNeAmJHxgsEOSdbG6bs22NOeVmnQkxtxvDKjMfXNPIzfZoPoTxrjrnZ5MP8eA8pQtxu4eC7prhVnr/YARjzHWuMFhJ4WpZATrYOEdh6xiV5eb57um32FeOt07Pe5MfM1DRQI3c82vBRKydLqoKL+BucmfiMXjZH4fZ1lxxDIyxXI9uIpyVKBMg/fPfcN+H4UhaIdfYCKgEYUEZwIDAQABo4HNMIHKMB0GA1UdDgQWBBTNjyK10oUHCfthcT8t/E85su4ZyTCBnQYDVR0jBIGVMIGSgBQf3FULkLMCn5fhk9WjpUdLWBaVAKFwpG4wbDELMAkGA1UEBhMCTkwxFjAUBgNVBAgTDU5vb3JkIEhvbGxhbmQxHDAaBgNVBAcTE0x1Y2h0aGF2ZW4gU2NoaXBob2wxDTALBgNVBAoTBEZMVVgxGDAWBgNVBAMTD0ZMVVggTkwgVEVTVCBDQYIIBLJ8Vn+Q6EkwCQYDVR0TBAIwADANBgkqhkiG9w0BAQUFAAOCAQEAG80vtoA79iC2FtDjvxzXxF2BTmseuzOseiKT/uGdiiaAUEiGR/UDRtMyUCLTZrKVbl5B/myquti5dNpTOYqfej07zYV8DZhLfjHZFA5MQh0I7pa5XJxxWyY3rhMVDreN8aG9cSK1dxIuuxhvUCmgpLxardQMP1KAdio1sOoa+eggPD9fHvTDSU2/yYNFkWhFuqL7yPr11FCdTxxGYEUCvinAnJdoIWWTgYMEsc1FCClQgGNq3YWyt17QHUoCOlIP+lwJqo8ZMm4Snu4h+39LuOYNnQzt8wgteZljXjubkpPjR0zNxzGXmsMWePdaSPdkAnKEeQYj758IpuXU6m5r2w==
               </wsse:BinarySecurityToken>
               <dsig:Signature xmlns:dsig="http://www.w3.org/2000/09/xmldsig#">
                    <dsig:SignedInfo>
                         <dsig:CanonicalizationMethod
                              Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
                         <dsig:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" />
                         <dsig:Reference URI="#Timestamp_hTfC4UvelIQ1rn58">
                              <dsig:Transforms>
                                   <dsig:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
                              </dsig:Transforms>
                              <dsig:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" />
                              <dsig:DigestValue>Cz65y09RWeYk3bns0Zr3oBW80H0=</dsig:DigestValue>
                         </dsig:Reference>
                         <dsig:Reference URI="#Body_pW1NfGuv6WDEeSpi">
                              <dsig:Transforms>
                                   <dsig:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
                              </dsig:Transforms>
                              <dsig:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" />
                              <dsig:DigestValue>htwgWFOYC84hfti4iXCCHh+deQs=</dsig:DigestValue>
                         </dsig:Reference>
                         <dsig:Reference URI="#bst_Wf9BN8DhNsWFJp0a">
                              <dsig:Transforms>
                                   <dsig:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
                              </dsig:Transforms>
                              <dsig:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" />
                              <dsig:DigestValue>iOWrjzD2sZxSPXAWm8ZCFmA6tTY=</dsig:DigestValue>
                         </dsig:Reference>
                    </dsig:SignedInfo>
                    <dsig:SignatureValue>HxJyWczUY0vDts7+L3fHQVOCk0u1RsRJa/uiYVLJFamKlUGsP65cAzXN07S0oxrU4L/1h98QtD+K9nwog4qpqcuA9ocACCHIk5mHKVOIe3mg5Fo6cXgVzKVecoX2pB1p7XE74rv3Pqt2Jlnm6h34zDHC4nWmqnpL9KYB2oy3b6h5JyZMUAcd7MuKZ9jE0rVthgWLPeskR/4HKjhAKn8E7p62N3EWl+zjttBpwflFplc2478k6l94MfGhAAAfyQGhwXYG8+Ntn7yx3iy3k0pbdqWv6Otr7Df0X+qtg2/dg+zkjqHYDtHDOhbOBM3xSuKB+JwKz/5S6QRcEhSUS67nVQ==
                    </dsig:SignatureValue>
                    <dsig:KeyInfo>
                         <wsse:SecurityTokenReference
                              xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"
                              xmlns:wsse11="http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd"
                              xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"
                              wsse11:TokenType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3"
                              wsu:Id="str_Lko8bqWzpHuAHfh0">
                              <wsse:Reference URI="#bst_Wf9BN8DhNsWFJp0a"
                                   ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3" />
                         </wsse:SecurityTokenReference>
                    </dsig:KeyInfo>
               </dsig:Signature>
               <wsu:Timestamp
                    xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"
                    wsu:Id="Timestamp_hTfC4UvelIQ1rn58">
                    <wsu:Created>2010-10-01T15:10:09Z</wsu:Created>
                    <wsu:Expires>2010-10-01T15:11:09Z</wsu:Expires>
               </wsu:Timestamp>
          </wsse:Security>
     </S:Header>
     <S:Body
          xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"
          wsu:Id="Body_pW1NfGuv6WDEeSpi">
          <ns3:echoComplexType xmlns:ns2="http://example.org/complex"
               xmlns:ns3="http://example.org">
               <arg0>
                    <intValue>999</intValue>
                    <stringValue>Hello Struct</stringValue>
               </arg0>
          </ns3:echoComplexType>
     </S:Body>
</S:Envelope>
Response
<?xml version='1.0' encoding='UTF-8'?>
<S:Envelope xmlns:S="http://schemas.xmlsoap.org/soap/envelope/">
     <S:Header>
          <wsse:Security
               xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"
               S:mustUnderstand="1">
               <dsig:Signature xmlns:dsig="http://www.w3.org/2000/09/xmldsig#">
                    <dsig:SignedInfo>
                         <dsig:CanonicalizationMethod
                              Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
                         <dsig:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" />
                         <dsig:Reference URI="#Timestamp_QqBGh7JHiRcPisbg">
                              <dsig:Transforms>
                                   <dsig:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
                              </dsig:Transforms>
                              <dsig:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" />
                              <dsig:DigestValue>QlAcOoVC9AaVR8qXElY0xcpL7No=</dsig:DigestValue>
                         </dsig:Reference>
                         <dsig:Reference URI="#Body_ELn3kyPvh9p7QpoV">
                              <dsig:Transforms>
                                   <dsig:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
                              </dsig:Transforms>
                              <dsig:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" />
                              <dsig:DigestValue>yQN4RviZ3zpJyZxLHrBv9d7cgds=</dsig:DigestValue>
                         </dsig:Reference>
                         <dsig:Reference URI="#str_nqug2feZarDRqizh">
                              <dsig:Transforms>
                                   <dsig:Transform     Algorithm="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#STR-Transform">
                                        <wsse:TransformationParameters>
                                             <dsig:CanonicalizationMethod
                                                  Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
                                        </wsse:TransformationParameters>
                                   </dsig:Transform>
                              </dsig:Transforms>
                              <dsig:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" />
                              <dsig:DigestValue>DVw6Uu/0QGb9WOROwxUGHidxdAU=</dsig:DigestValue>
                         </dsig:Reference>
                    </dsig:SignedInfo>
                    <dsig:SignatureValue>qgCaw39pMkxKTxaF0zupYoXNlHLQXww4MODkEJyoJJ/a/58sijzZ0JrD8Ni83Gb5LTflHlDkr6ANt/NPiauTu7azHnyMhQGtHhCY0tXk2XwS2tlKK1UP7dnZ7NazxSxSnAviHIgTHw1Ltg1XeOXjNrMmRRoaV1Lcb0ZfXUvSBiXGpBuprNYMqG/ARF6uV+sAUN2XFQkf+CLxNi6CBs+6M46yyy/FryvbHhlBLBBnyWXJ+yCo8TYhkKpo/moDFAUDAuhPBi60P7tocj/apxrjYZbaJVvIe+lHR09JxMZ5gdDTPAKuc3FQdt9p5yfA3m7mrNltlBY1I8RZSSb0ptItlg==
                    </dsig:SignatureValue>
                    <dsig:KeyInfo>
                         <wsse:SecurityTokenReference
                              xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"
                              xmlns:wsse11="http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd"
                              xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"
                              wsse11:TokenType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3"
                              wsu:Id="str_nqug2feZarDRqizh">
                              <wsse:KeyIdentifier
                                   EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary"
                                   ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentifier">S07jQjWN88pUII1gXUy7Hx60qC0=</wsse:KeyIdentifier>
                         </wsse:SecurityTokenReference>
                    </dsig:KeyInfo>
               </dsig:Signature>
               <wsu:Timestamp
                    xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"
                    wsu:Id="Timestamp_QqBGh7JHiRcPisbg">
                    <wsu:Created>2010-10-01T15:10:09Z</wsu:Created>
                    <wsu:Expires>2010-10-01T15:11:09Z</wsu:Expires>
               </wsu:Timestamp>
          </wsse:Security>
     </S:Header>
     <S:Body
          xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"
          wsu:Id="Body_ELn3kyPvh9p7QpoV">
          <ns2:echoComplexTypeResponse xmlns:ns2="http://example.org"
               xmlns:ns3="http://example.org/complex">
               <ns3:EchoStructReturnMessage>
                    <intValue>999</intValue>
                    <stringValue>Hello Struct</stringValue>
               </ns3:EchoStructReturnMessage>
          </ns2:echoComplexTypeResponse>
     </S:Body>
</S:Envelope>
Client
package examples.webservices.simple_client;
import java.security.cert.X509Certificate;
import java.util.ArrayList;
import java.util.List;
import java.util.Map;
import javax.xml.ws.BindingProvider;
import weblogic.security.SSL.TrustManager;
import weblogic.wsee.security.bst.ClientBSTCredentialProvider;
import weblogic.wsee.security.util.CertUtils;
import weblogic.xml.crypto.wss.WSSecurityContext;
import weblogic.xml.crypto.wss.provider.CredentialProvider;
public class SecureMain2 {
     public static void main(String ar[]) throws Exception {
          ComplexService test = new ComplexService();
          ComplexPortType port = test.getComplexPortTypePort();
          BasicStruct in = new BasicStruct();
          in.setIntValue(999);
          in.setStringValue("Hello Struct");
          // String constants to for server certificate, and client identity store
          String serverCertFile = "D:\\Development\\WebLogic-keystores\\client_trust.der";
          String clientKeyStore = "D:\\Development\\WebLogic-keystores\\client_store.jks";
          String clientKeyStorePass = "password";
          String clientKeyAlias = "alias";
          String clientKeyPass = clientKeyStorePass;
          // Create list of credential providers
          List<CredentialProvider> credProviders = new ArrayList<CredentialProvider>();
          // Create a credential provider with the client indentity and the server side certificate
          final X509Certificate serverCert = (X509Certificate) CertUtils.getCertificate(serverCertFile);
          serverCert.checkValidity();
          CredentialProvider cp = new ClientBSTCredentialProvider(clientKeyStore, clientKeyStorePass, clientKeyAlias, clientKeyPass, "JKS",
                    serverCert);
          credProviders.add(cp);
          // Finally add the credential providers to the request context
          Map<String, Object> requestContext = ((BindingProvider) port).getRequestContext();
          requestContext.put(WSSecurityContext.CREDENTIAL_PROVIDER_LIST, credProviders);
          // Setup the TrustManager to verify the signature on the returned message
          requestContext.put(WSSecurityContext.TRUST_MANAGER, new TrustManager() {
               public boolean certificateCallback(X509Certificate[] chain, int validateErr) {
                    // Check that the server cert matches
                    boolean result = chain[0].equals(serverCert);
                    return result;
          // Invoke the service
          BasicStruct result = port.echoComplexType(in);
          System.out.println("\n\n\t Service returned: " + result.getStringValue());
Web service
package examples.webservices.complex;
// Import the standard JWS annotation interfaces
import javax.jws.WebMethod;
import javax.jws.WebParam;
import javax.jws.WebResult;
import javax.jws.WebService;
import javax.jws.soap.SOAPBinding;
import weblogic.jws.Policy;
// Import the BasicStruct JavaBean
import examples.webservices.complex.BasicStruct;
// Standard JWS annotation that specifies that the portType name of the Web
// Service is "ComplexPortType", its public service name is "ComplexService",
// and the targetNamespace used in the generated WSDL is "http://example.org"
@WebService(serviceName="ComplexService", name="ComplexPortType",
            targetNamespace="http://example.org")
// Standard JWS annotation that specifies this is a document-literal-wrapped
// Web Service
@SOAPBinding(style=SOAPBinding.Style.DOCUMENT,
             use=SOAPBinding.Use.LITERAL,
             parameterStyle=SOAPBinding.ParameterStyle.WRAPPED)
@Policy(uri="policy:Wssp1.2-2007-Wss1.0-X509-Basic256.xml")
* This JWS file forms the basis of a WebLogic Web Service.  The Web Services
* has two public operations:
*  - echoInt(int)
*  - echoComplexType(BasicStruct)
* The Web Service is defined as a "document-literal" service, which means
* that the SOAP messages have a single part referencing an XML Schema element
* that defines the entire body.
public class ComplexImpl {
  // Standard JWS annotation that specifies that the method should be exposed
  // as a public operation.  Because the annotation does not include the
  // member-value "operationName", the public name of the operation is the
  // same as the method name: echoInt.
  // The WebResult annotation specifies that the name of the result of the
  // operation in the generated WSDL is "IntegerOutput", rather than the
  // default name "return".   The WebParam annotation specifies that the input
  // parameter name in the WSDL file is "IntegerInput" rather than the Java
  // name of the parameter, "input".
  @WebMethod()
  @WebResult(name="IntegerOutput",
             targetNamespace="http://example.org/complex")
  public int echoInt(
      @WebParam(name="IntegerInput",
                targetNamespace="http://example.org/complex")
      int input)
    System.out.println("echoInt '" + input + "' to you too!");
    return input;
  // Standard JWS annotation to expose method "echoStruct" as a public operation
  // called "echoComplexType"
  // The WebResult annotation specifies that the name of the result of the
  // operation in the generated WSDL is "EchoStructReturnMessage",
  // rather than the default name "return".
  @WebMethod(operationName="echoComplexType")
  @WebResult(name="EchoStructReturnMessage",
             targetNamespace="http://example.org/complex")
  public BasicStruct echoStruct(BasicStruct struct)
    System.out.println("echoComplexType called");
    return struct;
}

Answer 1

Hi ,
I have used the same Web Service Code provided by you and tried to execute the Standalone client ( as pasted by you here ) against the service and after some modification I was able to get the signature validation to true .
Here is the client I have used :
package examples.webservices.simple_client;
import java.security.cert.X509Certificate;
import java.util.ArrayList;
import java.util.List;
import java.util.Map;
import javax.xml.ws.BindingProvider;
import weblogic.security.SSL.TrustManager;
import weblogic.wsee.security.bst.ClientBSTCredentialProvider;
import weblogic.wsee.security.util.CertUtils;
import weblogic.xml.crypto.wss.WSSecurityContext;
import weblogic.xml.crypto.wss.provider.CredentialProvider;
import examples.webservices.complex.BasicStruct;
import javax.xml.rpc.Stub;
public class SecureMain2 {
     public static void main(String ar[]) throws Exception {
          ComplexService test = new ComplexService_Impl();
          ComplexPortType port = test.getComplexPortTypeSoapPort();
          BasicStruct in = new BasicStruct();
          in.setIntValue(999);
          in.setStringValue("Hello Struct");
          // String constants to for server certificate, and client identity store
          String serverCertFile = "E:\\wls_docs\\web_service\\demo.cer";
          String clientKeyStore = "E:\\wls_docs\\web_service\\DemoIdentity.jks";
          String clientKeyStorePass = "DemoIdentityKeyStorePassPhrase";
          String clientKeyAlias = "DemoIdentity";
          String clientKeyPass = "DemoIdentityPassPhrase";
          // Create list of credential providers
          List<CredentialProvider> credProviders = new ArrayList<CredentialProvider>();
          // Create a credential provider with the client indentity and the server side certificate
          final X509Certificate serverCert = (X509Certificate) CertUtils.getCertificate(serverCertFile);
          serverCert.checkValidity();
          CredentialProvider cp = new ClientBSTCredentialProvider(clientKeyStore, clientKeyStorePass, clientKeyAlias, clientKeyPass, "JKS",
                    serverCert);
          credProviders.add(cp);
          Stub stub = (Stub)port;
          stub._setProperty(WSSecurityContext.CREDENTIAL_PROVIDER_LIST, credProviders);
          stub._setProperty(WSSecurityContext.TRUST_MANAGER,
                    new TrustManager(){
                    public boolean certificateCallback(X509Certificate[] chain, int validateErr){
                         boolean result = chain[0].equals(serverCert);
                         System.out.println(" Validating Signature" );
                         System.out.println(" Result is " +result ) ;
                    return result;
          // Finally add the credential providers to the request context
          //Map<String, Object> requestContext = ((BindingProvider) port).getRequestContext();
          //requestContext.put(WSSecurityContext.CREDENTIAL_PROVIDER_LIST, credProviders);
          // Setup the TrustManager to verify the signature on the returned message
          //requestContext.put(WSSecurityContext.TRUST_MANAGER, new TrustManager() {
               //public boolean certificateCallback(X509Certificate[] chain, int validateErr) {
                    // Check that the server cert matches
                    //boolean result = chain[0].equals(serverCert);
                    //return result;
          // Invoke the service
          BasicStruct result = port.echoComplexType(in);
          System.out.println("\n\n\t Service returned: " + result.getStringValue());
Thanks,
Sandeep