I want to encrypt the body of the SOAP XML document. It works perfectly fine with SoapUI, where I use certificate, Subject Key Identifier as Key Identifier Type, AES256-CBC encoding and RSA 1_5 encryption algorithm. I also checked the box to create encrypted key. I want to recreate there settings with python code, using the following code:

def encrypt(envelope, certfile):
    """Encrypt body contents of given SOAP envelope using given X509 cert."""
    doc = etree.fromstring(envelope)

    security = get_security_header(doc)

    # Create a keys manager and load the cert into it.
    manager = xmlsec.KeysManager()
    key = xmlsec.Key.from_file(certfile, xmlsec.KeyFormat.CERT_PEM, None)
    manager.add_key(key)

    body = doc.find(ns(SOAP_NS, 'Body'))

    enc_data = xmlsec.template.encrypted_data_create(
        body,
        xmlsec.constants.TransformAes256Cbc,
        type=xmlsec.EncryptionType.CONTENT,
        ns='xenc',
    )
    xmlsec.template.encrypted_data_ensure_cipher_value(enc_data)
    key_info = xmlsec.template.encrypted_data_ensure_key_info(
        enc_data, ns='ds')

    enc_key = xmlsec.template.add_encrypted_key(
        key_info, xmlsec.constants.TransformRsaPkcs1)
    #enc_key.append(create_key_info_ski(certfile))
    xmlsec.template.encrypted_data_ensure_cipher_value(enc_key)

    enc_ctx = xmlsec.EncryptionContext(manager)
    # Generate a per-session DES key (will be encrypted using the cert).
    enc_ctx.key = xmlsec.Key.generate(
        xmlsec.constants.KeyDataAes, 256, xmlsec.constants.KeyDataTypeSession)

    # Ask XMLSec to actually do the encryption.
    enc_data = enc_ctx.encrypt_xml(enc_data, body)


    # Move the EncryptedKey node up into the wsse:Security header.
    security.append(enc_key)

    add_data_reference(enc_key, enc_data)

    enc_data.remove(key_info)
    return doc

def create_key_info_ski(certfile):
    key_info = etree.Element(f"{{{DS_NS}}}KeyInfo", nsmap=namespaces)
    security_token_reference = etree.Element(f"{{{WSSE_NS}}}SecurityTokenReference")

    key_identifier = etree.Element(f"{{{WSSE_NS}}}KeyIdentifier",
                                   ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentifier",
                                   EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary")
    key_identifier.text = extract_ski(certfile)
    security_token_reference.append(key_identifier)
    key_info.append(security_token_reference)
    return key_info

Everything seems ok if I don’t use X509SubjectKeyIdentifier. So if I comment out line

#enc_key.append(create_key_info_ski(certfile))

I get the following error:

xmlsec.Error: (1, 'failed to encrypt xml')

Are keys correctly used? What am I missing?