I have a problem calling a SOAP Web Service.
When I send my signed message from my local machine to the service I get a correct response.
When I do the exact same thing from a machine in the production environment server setup I get a “The signature verification failed” response.
I am not a system administrator, but I imagine that the production environment is set up with all the trimmings; load balancing, firewalls, etc.
The service producer have sent med a copy of the exact received soap messages from my two calls. In the case where it goes well, the received message looks exactly like the one I sent, pretty-printed and all. But in the failed case the received message has been reformatted into three lines. Yes it is still valid XML, but I am quite sure that if even a single linebreak is changed in a signed message, the signature is no longer valid.
But what entity in a server setup could possibly do such a thing?
The problem was that in the problematic environment, the communication was blocked when attempts were made to verify certificates by calling the certificate revocation list.