metadata signature

[Jonathan Bricker]

I'm adding a Signature metadata filter for my SP.  I changed the key and certificate in the my test IDP to do this test.  I was unable to get the IDP to generate the new metadata so I put the new public key in the old metadata.  Without the filter this it works.  With the filter I'm getting this error.

2011-10-03 07:00:01 WARN OpenSAML.MetadataFilter.Signature : filtering out group at root of instance after failed signature check: Root metadata element was unsigned.
2011-10-03 07:00:01 CRIT Shibboleth.Application : error initializing MetadataProvider: SignatureMetadataFilter unable to verify signature at root of metadata instance.

I'm trying to figure out where the problem might be.  The Filter looks like this:

<MetadataProvider type="XML" uri="http://localhost:8080/saml-metadata/smd"
                backingFilePath="saml-metadata.xml" reloadInterval="60">
                <MetadataFilter type="Signature" verifyName="false">
                                <TrustEngine type="StaticPKIX" verifyDepth="5" checkRevocation="entityOnly">
                                                <CredentialResolver type="Chaining">
                                                                <CredentialResolver type="File">
                                                                                <Certificate format="PKCS12" password="apsswrd">
                                                                                                <Path>/etc/shibboleth/credentials/ec2idp.pfx</Path>
                                                                                </Certificate>
                                                                </CredentialResolver>
                                                </CredentialResolver>
                                </TrustEngine>
                </MetadataFilter>
</MetadataProvider>

The cert CN matches the entity ID.   I'm not sure what to look for with this or which parts of the logger I should turn on.

Thanks,

Jonathan Bricker
Senior Software Engineer
ExactTarget
Office  |  317.524.2789
Mobile  |  317.435.0763
U.S. Technical Support | 866.558.9823
International Technical Support | +1.317.275.5483
Email l jbricker at exacttarget.com<mailto:jsmith at exacttarget.com>

[cid:image001.gif at 01CC81BC.EA2379D0]<http://email.exacttarget.com/hub/index.html>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20111003/804f254a/attachment-0001.html 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image001.gif
Type: image/gif
Size: 11913 bytes
Desc: image001.gif
Url : http://shibboleth.net/pipermail/users/attachments/20111003/804f254a/attachment-0001.gif