Lax SecurityHeaderLayout doesn't seem to be allowing timestamp to come last - wcf

Question

I am using the following binding for my service:
<customBinding>
<binding closeTimeout="00:10:00" openTimeout="00:10:00" receiveTimeout="00:10:00" sendTimeout="00:10:00">
<textMessageEncoding messageVersion="Soap12">
<readerQuotas maxDepth="2147483647" maxBytesPerRead="2147483647" maxArrayLength="2147483647"
maxStringContentLength="2147483647" maxNameTableCharCount="2147483647" />
</textMessageEncoding>
<security authenticationMode="CertificateOverTransport" allowInsecureTransport="true" />
<httpTransport maxBufferPoolSize="2147483647" maxBufferSize="2147483647" maxReceivedMessageSize="2147483647" />
</binding>
</customBinding>
This defaults securityHeaderLayout on the security node to Strict, which requires the Timestamp node in the message to come first. I am working with another part of the corporation that does not use WCF, so the individual with whom I am working is trying to use SoapUI to test the service. SoapUI adds the Timestamp node at the end of the message. This can be moved manually, but, apparently, it gets moved back once you sign the node - so you can either have the node come first, or you can have it signed, but not both.
I've tried setting the security node to use Lax or LaxTimestampLast, but it doesn't seem to make a difference:
<security authenticationMode="CertificateOverTransport" allowInsecureTransport="true" securityHeaderLayout="Lax|LaxTimestampLast" />
When I call with my own (WCF) client using LaxTimestampLast, it fails (MessageSecurityException: Signing without primary signature requires timestamp.). Any direction would be greatly appreciated.

Answer 1

I had this same issue recently and I solved it by setting the messageSecurityVersion in my customBinding to a WSSecurity10 version, it had previously had a WSSecurity11 version. Here is my custom binding that works with both my WCF Client and SoapUI:
<customBinding>
<binding name="CustomBinding">
<security authenticationMode="MutualCertificate"
messageSecurityVersion="WSSecurity10WSTrustFebruary2005WSSecureConversationFebruary2005WSSecurityPolicy11BasicSecurityProfile10"
requireDerivedKeys="false" securityHeaderLayout="Lax" />
<textMessageEncoding messageVersion="Soap11" />
<httpsTransport />
</binding>
</customBinding>