Centralized Discovery Service: problem with <ds:signature>

[Peter Schober]

* Pascal Panneels <pascal.panneels at belnet.be> [2013-06-20 11:25]:
> I know that the certificate present in their metadata is a
> self-signed.  Is that the cause of the problem ?
> 
> Is there a tool in the Shibboleth stuff to help me verify the
> signature of the metadata "by hand" (I mean using command line...) ?

How would you verify a signature from a self-issued key? You certainly
can do that (verbatim) but the authenticity of the signing key itself
is not verified by anything here (i.e., the key itself is still not
trustworthy).
If on the other hand you have verified the authenticity of the key
included in the metadata (e.g. out of band with the SP) -- assuming
that same key was used to sign the metadata -- you can strip the
signature from your copy of the SP's EntityDescriptor.

Unless I'm confusing things, which might happen when the temperature
crawls towards 37°C, as we're experiencing today,
-peter