Certificate Issue

[Islam Gomaa]

Good morning everyone,

I have renewed the Service provider SAML certificate, the federation metadata is refreshed and shows the same certificate.
When I try to test and login I get the following error in the browser

opensaml::FatalProfileException at (https://e5.onthehub.com/WebStore/Security/Shibboleth/SWITCHaai/Shibboleth.sso/SAML2/POST)
A valid authentication statement was not found in the incoming message.

I have created the self-sign cert using keygen.bat that comes with Shibboleth SP, I have verified that the key is not encrypted and match the certificate, In ShibD logs i see the following error:
2013-03-04 13:39:20 DEBUG OpenSAML.MessageDecoder.SAML2 [1]: message from (https://aai-logon.vho-switchaai.ch/idp/shibboleth)
2013-03-04 13:39:20 DEBUG OpenSAML.MessageDecoder.SAML2 [1]: searching metadata for message issuer...
2013-03-04 13:39:20 DEBUG OpenSAML.SecurityPolicyRule.MessageFlow [1]: evaluating message flow policy (replay checking on, expiration 60)
2013-03-04 13:39:20 DEBUG XMLTooling.StorageService [1]: inserted record (_c0bfab787f77320b360c228bcf283aed) in context (MessageFlow)
2013-03-04 13:39:20 DEBUG OpenSAML.SecurityPolicyRule.XMLSigning [1]: validating signature profile
2013-03-04 13:39:20 DEBUG XMLTooling.KeyInfoResolver.Inline [1]: resolving ds:X509Certificate
2013-03-04 13:39:20 DEBUG XMLTooling.KeyInfoResolver.Inline [1]: resolved 1 certificate(s)
2013-03-04 13:39:20 DEBUG XMLTooling.KeyInfoResolver.Inline [1]: resolved 0 CRL(s)
2013-03-04 13:39:20 DEBUG OpenSAML.SecurityPolicyRule.XMLSigning [1]: signature verified against message issuer
2013-03-04 13:39:20 DEBUG XMLTooling.KeyInfoResolver.Inline [1]: resolved 0 certificate(s)
2013-03-04 13:39:20 DEBUG XMLTooling.KeyInfoResolver.Inline [1]: resolving ds:X509Certificate
2013-03-04 13:39:20 DEBUG XMLTooling.KeyInfoResolver.Inline [1]: resolved 1 certificate(s)
2013-03-04 13:39:20 WARN XMLTooling.Decrypter [1]: Credential did not contain a private key.
2013-03-04 13:39:20 ERROR Shibboleth.SSO.SAML2 [1]: Unable to decrypt

Does anybody know what the problem might be?
Thanks!


Islam Gomaa
Systems Architect /Manager, Information Technology
T +1 613.526.3005 x 135
M +1 613.878.8182
F +1 613.526.3891

[cid:image003.png at 01CD7B4A.37A02190]<http://www.kivuto.com/>
Kivuto.com<http://www.kivuto.com/> | The evolution of e-academy.


 
 
************************************************************************************
This footnote confirms that this email message has been scanned by
PineApp Mail-SeCure for the presence of malicious code, vandals & computer viruses.
************************************************************************************



-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130304/e54456ad/attachment.html 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image001.png
Type: image/png
Size: 4671 bytes
Desc: image001.png
Url : http://shibboleth.net/pipermail/users/attachments/20130304/e54456ad/attachment.png