an additional note:
We can temporarily solve this issue by specifying the encryption alias in the jboss-wsse-server.xml, but doing this means other clients (using other aliases) can't interact with the service...
<config>
<timestamp ttl="300" />
<sign type="x509v3" alias="server" includeTimestamp="true" />
<!-- doesn't work -->
<encrypt type="x509v3" algorithm="aes-128" keyWrapAlgorithm="rsa_oaep"
tokenReference="keyIdentifier" />
<!-- does work but disables other clients -->
<encrypt type="x509v3" algorithm="aes-128" keyWrapAlgorithm="rsa_oaep"
tokenReference="keyIdentifier" alias="specific_client_to_encrypt_to" />
<requires>
<signature />
<encryption />
</requires>
<authenticate>
<signatureCertAuth certificatePrincipal="org.jboss.security.auth.certs.SubjectCNMapping" />
</authenticate>
</config>