Below is the result of the packet encrypted after the WSE is serialized at runtime
XML Version = "1.0" encoding = "UTF-8"?>
XMLns: xsi = "http://www.w3.org/2001/xmlschema-instance" XMLns: xsd = "http://www.w3.org/2001/xmlschema"> XMLns: WSU = "http://schemas.xmlsoap.org/ws/2002/07/UTILITY"> wsu: TimeStamp> XMLns: wsse = "http://schemas.xmlsoap.org/ws/2002/07/secext"> TYPE = "http://www.w3.org/2001/04/xmlenc#encryptedkey" XMLns: Xenc = "http://www.w3.org/2001/04/xmlenc#"> Algorithm = "http://www.w3.org/2001/04/xmlenc#rsa-1_5" /> Ymlkvwxyd8vuguyliuioxoy7zyn9pwhbfahciyov0aydeaqqpw = wsse: keyidentifier> wss: securityTokenReference> KeyInfo> UYKGBEXDY8LYSZQGDGXOXOY7ZYN9PWHBFAHCIYOV0 ... BWRNWK = xenc: ciphervalue> xenc: cipherdata> "# EncryptedContent-CF014249-0E2A-4F8B-9002-13A7DE916BE0" /> xenc: refrescelist> xenc: encryptedkey> TYPE = "http://www.w3.org/2001/04/xmlenc#encryptedkey" XMLns: Xenc = "http://www.w3.org/2001/04/xmlenc#"> Algorithm = "http://www.w3.org/2001/04/xmlenc#rsa-1_5" /> Ymlkvwxyd8vuguyliuiydeaqqpw = wsse: keyidentifier> wss: securityTokenReference> KeyInfo> IN8KF1CIJJJXCLZ ... WMQBeevxmzk = xenc: ciphervalue> xenc: cipherdata> "# EncryptedContent-0744279A-02BF-4AD1-998E-622208EDED0E" /> xenc: refrescelist> xenc: encryptedkey> wss: security> soap: header> THIS Part of The Response Does Not NEED ENCRYPTION Notencrypted> WSU: ID = "ID: E5E8D792-ABE7-4476-91D0-856FBDF4A958" XMLns: WSU = "http://schemas.xmlsoap.org/ws/2002/07/UTILITY"> ID = "EncryptedContent-CF014249-0E2A-4F8B-9002-13A7DE916BE0" TYPE = "http://www.w3.org/2001/04/xmlenc#content" XMLns: Xenc = "http://www.w3.org/2001/04/xmlenc#"> Algorithm = "http://www.w3.org/2001/04/xmlenc#tripledes-cbc" /> 2MnHckgvh / 5JB0PF4PCH3U2VAUKSWSA ... AFEVJZT = xenc: ciphervalue> xenc: cipherdata> xenc: encrypteddata> EncryptedResponse> response> GetXmldocumentResult> GetXmldocumentResponse> soap: body> soap: envelope> Note that in this encrypted message, there is a binaryseircurityToken element for representing the X.509 certificate, but there are two separate EncryptedKey elements, each EncryptedData element is added to SOAPCONText, which is encrypted in the outermost EncryptedResponse, you can only see EncryptedData elements. When EncryptedResponse is encrypted, the EncryptedData element that represents EncryptedSub elements is also converted to ciphertext. When this message is received at the client, SecurityInputFilter uses information from the mark to obtain a private key that has been decrypted by the two EncryptedKey elements.