I think its a bug with wss4j-1.6.0.jar I replaced this with wss4j-1.6.3.jar it works.
-- View this message in context: http://cxf.547215.n5.nabble.com/moving-to-cxf-2-5-org-apache-ws-security-WSSecurityException-The-signature-or-decryption-was-invalid-tp5077993p5080564.html Sent from the cxf-user mailing list archive at Nabble.com.