Ok, I actually found my issue shortly after I posted this, and I'll share it here. Basically, I was doing too much marshalling. Once I took out the separate marshalling of the timestamp AND the signature, and just marshalled the security root, it was all set. Thanks for looking. -- Sent from: http://shibboleth.1660669.n2.nabble.com/Shibboleth-Developers-f1660781.html