Using a second signing certificate

[Jason Gauthier]

>>I am using Shibboleth as a service provider for an ADFS idP.  I have 
>>two signing certificates. One that expires on 07/28, and the other that 
>>becomes (became) effective on 07/09.  Because of the change it caused 
>>all of my Shib service providers to stop working.

>That cannot be the cause. Shibboleth SPs don't stop working because of certificate expirations, only if you provide incorrect metadata.

Well, then I supposed I've done something wrong.
I acquired my metadata from ADFS:
https://ADFS/FederationMetadata/2007-06/FederationMetadata.xml

>The certificates don't have to be valid, and you should not change keys because of a certificate expiring. Or ever, unless you have an actual reason >based on key compromise or some legitimate justification that the key may be vulnerable.

This metadata is signed, and I had to remove all of the signature data following these instructions:
http://technet.microsoft.com/en-us/library/gg317734(v=ws.10).aspx
in addition to adding some items.
under the section "To create edited AD FS 2.0 metadata with an added scope element"

Perhaps I've approached this incorrectly.

However, when I simply use the metadata straight from ADFS, authorization doesn't work because apparent Shibd doesn't like the metadata:

Not normally logged:
2013-07-15 12:34:40 WARN Shibboleth.AttributeFilter [4]: removed value at position (0) of attribute (eppn) from (http://ADFS/adfs/services/trust)