Signature trust could not be established via PKIX validation of signing credential

[Cantor, Scott]

> I've not modified any trust engines from the default in relying-party.xml.  If it
> didn't work, what log would show that?  This is what I have currently in
> relying-party.xml:

I did some testing and without turning up logging a lot, you won't see much actually. But based on you not having changed anything, which I expected, what I can tell is: you're wrong about the certificate matching. That's all it really can be.

> Okay, that is good to know.  Since the entire certificate including the key
> matches in both the AuthnRequest and the metadata, it must not be
> checking for some reason.

No, what it means is they don't match, which means you're mistaken or the metadata isn't what you believe it is. If it wasn't checking, it wouldn't fail at all.

>  Unless there is something wrong/missing in the
> configuration above, what else would cause that?  I checked the metadata
> sources for duplicate entityIDs (sanity check as you'd suggested) and there
> were no duplicates.

Then I have no other suggestions. They simply don't match, unless something that's never been observed before is involved.

You can certainly turn up org.opensaml and see what it tells you.

-- Scott