Signature trust could not be established via PKIX validation of signing credential

[Schumacher, Adam J.]

> Then I have no other suggestions. They simply don't match, unless
> something that's never been observed before is involved.
> 
I promise I'm not crazy.  I had the SP generate a new self-signed certificate, just to see if somehow something got corrupted or copied wrong in the metadata or request.  Same error.  Here is what is in the metadata:

    <md:KeyDescriptor>
      <X509Data xmlns="http://www.w3.org/2000/09/xmldsig#">
        <X509SubjectName>CN=ip-0A420AEF</X509SubjectName>
        <X509Certificate>
MIIC2jCCAcKgAwIBAgIQLdMhXo4Hp5ND0celH+DyTjANBgkqhkiG9w0BAQUFADAW
MRQwEgYDVQQDEwtpcC0wQTQyMEFFRjAeFw0xMzA3MTAyMjQzMzRaFw0xNDA3MTAw
MDAwMDBaMBYxFDASBgNVBAMTC2lwLTBBNDIwQUVGMIIBIjANBgkqhkiG9w0BAQEF
AAOCAQ8AMIIBCgKCAQEA4qckgnFdgiujhXEEPbLa0so9+YL/eu3Nv+EebPb8n+Q9
rsoQizgBl9McqD0ShTL29lzY9sueCE68aVDmabE7QHZCgPca09P8KUcVuCQEaP3H
lYSWJy5EftrKyTUWhL7IS84VZNEx6jB4sjJVwHhDkZ//bxUZAYjxS8/leEEsyxnL
VSym30P5um3f6mM8sR3KepYauZDBN1iNWW7WorWFWRWk0lLrTMiBbOVeXOBo2aQr
Tm21tnnufoLG7uAn/jqXX+QBdDtYDfgFXEkKF2jTaJoMp32nmciZNNmGVny29Fgz
O6hXcRuNRJRyhkVBWZWXWBmcy7BzBDljUth9uwJj3wIDAQABoyQwIjALBgNVHQ8E
BAMCBDAwEwYDVR0lBAwwCgYIKwYBBQUHAwEwDQYJKoZIhvcNAQEFBQADggEBADG6
okcTSsCxVRJueuh3CSoaMt8D8uGus5jvj9XZWkd7LKO5FESpndavTcAQPd4F5KKE
7/cmLTkxPYODPzRF/PeOM22AZWf2HPiXu7zufhHI9TGYcdr5PeBesLbGYS0Bcjkg
DGonXS8UatwXQUIEZI4t8Aug/9PakTn6B3RJ7iKqYzUO0jvZGs9EZzHwS5Ajp7E3
HkI1P4blCqJ2PotObXghp75dBokU18QDKFL3CspkdrELeyyCoj1MUmLJg3FPhw8m
/cK+kHlj2NnaJ0AWirLfj4bxcaC6tOEEUia9ckYa8OwKkUrX6xuEICbMmUxpJizz
F2u5OuKzfJBwHn+DaOA=
        </X509Certificate>
      </X509Data>
    </md:KeyDescriptor>

And here is what is in the AuthN Request:

<Signature xmlns="http://www.w3.org/2000/09/xmldsig#">
    <SignedInfo>
      <CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
      <SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" />
      <Reference URI="#_DE418A28BE6269AA0FE1F12E5BDEC8B7">
        <Transforms>
          <Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" />
          <Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#">
            <InclusiveNamespaces PrefixList="#default saml ds xs xsi" xmlns="http://www.w3.org/2001/10/xml-exc-c14n#" />
          </Transform>
        </Transforms>
        <DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" />
        <DigestValue>ARSgRTlvCpMEuBjyJqggje2HkEk=</DigestValue>
      </Reference>
    </SignedInfo>
    <SignatureValue>MW43YAcuugYWXy3hugk51djTemxXN4VzePnid+TqEQU7wdGtZn4ee6MRhiOZ9o4EyuyCPeKIcllFBMsvpDWyf/LL9c9jSrdsa6YbclJq5xiJlcKOTTWm+9uzKBb/DX3PW+wCy208WszplzNrTvdNRU0JR2/pcrT4O2FMVLE3X8OjmIT1WKX7+yEZYNDj/lttoz0/89jndP96p6l0lixvHuKgO3l4X7IZJeFzgv71ZKawDHFfUF5ydWui2lm39vl0AF1ltaqnI27m76zDtXlFDHjLsMGOXR0WakWxVA+GYph2ywu6O3/UkCHtvdM4SOGkAi5u8TTlziue8WTluR0B3g==</SignatureValue>
    <KeyInfo>
      <X509Data>
        <X509Certificate>MIIC2jCCAcKgAwIBAgIQLdMhXo4Hp5ND0celH+DyTjANBgkqhkiG9w0BAQUFADAWMRQwEgYDVQQDEwtpcC0wQTQyMEFFRjAeFw0xMzA3MTAyMjQzMzRaFw0xNDA3MTAwMDAwMDBaMBYxFDASBgNVBAMTC2lwLTBBNDIwQUVGMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA4qckgnFdgiujhXEEPbLa0so9+YL/eu3Nv+EebPb8n+Q9rsoQizgBl9McqD0ShTL29lzY9sueCE68aVDmabE7QHZCgPca09P8KUcVuCQEaP3HlYSWJy5EftrKyTUWhL7IS84VZNEx6jB4sjJVwHhDkZ//bxUZAYjxS8/leEEsyxnLVSym30P5um3f6mM8sR3KepYauZDBN1iNWW7WorWFWRWk0lLrTMiBbOVeXOBo2aQrTm21tnnufoLG7uAn/jqXX+QBdDtYDfgFXEkKF2jTaJoMp32nmciZNNmGVny29FgzO6hXcRuNRJRyhkVBWZWXWBmcy7BzBDljUth9uwJj3wIDAQABoyQwIjALBgNVHQ8EBAMCBDAwEwYDVR0lBAwwCgYIKwYBBQUHAwEwDQYJKoZIhvcNAQEFBQADggEBADG6okcTSsCxVRJueuh3CSoaMt8D8uGus5jvj9XZWkd7LKO5FESpndavTcAQPd4F5KKE7/cmLTkxPYODPzRF/PeOM22AZWf2HPiXu7zufhHI9TGYcdr5PeBesLbGYS0BcjkgDGonXS8UatwXQUIEZI4t8Aug/9PakTn6B3RJ7iKqYzUO0jvZGs9EZzHwS5Ajp7E3HkI1P4blCqJ2PotObXghp75dBokU18QDKFL3CspkdrELeyyCoj1MUmLJg3FPhw8m/cK+kHlj2NnaJ0AWirLfj4bxcaC6tOEEUia9ckYa8OwKkUrX6xuEICbMmUxpJizzF2u5OuKzfJBwHn+DaOA=</X509Certificate>

      </X509Data>
    </KeyInfo>
  </Signature>


> You can certainly turn up org.opensaml and see what it tells you.
>
It was already at TRACE and the logs I pasted previously are all it gave me. 

::Adam