Error: message was signed but signature could not be verified

Tue Aug 9 20:50:09 BST 2011

Hello All,

We've recently made some configuration changes on our Shibboleth 2.0 IDP
which has never been in production. One change was the installation of a
new 2048 bit security certificate on the Shibboleth server. Shibboleth
IDP was reinstalled using the windows installer. 

Testing with testshib I am able to get to the login page of my IDP, and
authenticate. However, afterwards I am redirected to
https://sp.testshib.org/Shibboleth.sso/SAML2/POST. This page yields an
error message, below. 

Can someone please help me resolve this issue? 

opensaml::FatalProfileException

The system encountered an error at Tue Aug 9 15:05:23 2011

To report this problem, please contact the site administrator at
root at localhost.

Please include the following message in any email:

opensaml::FatalProfileException at
(https://sp.testshib.org/Shibboleth.sso/SAML2/POST)

Message was signed, but signature could not be verified.

The idp-process log shows (edited for privacy)

15:05:24.379 - INFO [Shibboleth-Access:73] -
20110809T190524Z|xx.xx.xx.xx|login.randolphcollege.edu:443|/profile/SAML
2/Redirect/SSO|

15:05:24.462 - INFO [Shibboleth-Audit:950] -
20110809T190524Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect|_4a4
a4822203ca20b2aesrtasddfasdfaa92|https://sp.testshib.org/shibboleth-sp|u
rn:mace:shibboleth:2.0:profiles:saml2:sso|https://login.randolphcollege.
edu/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_633f4
564356435643564564539|myusername|urn:oasis:names:tc:SAML:2.0:ac:classes:
PasswordProtectedTransport||_2a596c96e2e2fb674cca8f091cd587d4||

Kindest Regards,

Skylar Hansen

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20110809/8537f38b/attachment.html 