SP- verifying message signature with Verisign issued certificate

[Daniel Gay]

I've had Shibboleth SP (2.5.2) installed, configured, and working well for
some time now.  However, the partner I am integrating with (a commercial
company, uses Ping Federate) is requiring me to make the following change:
use their Verisign issued certificate for verifying message signatures.
 They were previously using a self-signed certificate, and everything was
working well.

After reading the SP documentation, I concluded that I need to configure a
new trust engine, so added this to the configuration under the
ApplicationOverride element for this partner:

<TrustEngine type="StaticPKIX" certificate="/etc/shibboleth/sso.crt" />

where sso.crt is the Verisign issued certificate.  When I restart the shibd
daemon, I see that it is picking up the cert in the logs:

2014-02-21 18:07:24 INFO Shibboleth.Application : building TrustEngine of
type StaticPKIX...
2014-02-21 18:07:24 INFO XMLTooling.SecurityHelper : loading certificate(s)
from file (/etc/shibboleth/sso.crt)
2014-02-21 18:07:24 INFO XMLTooling.CredentialResolver.File : no private
key resolved, usable for verification/trust only.

However, when the partner attempts to login, they get an error and I see
this in the log:

2014-02-21 18:28:30 DEBUG OpenSAML.MessageDecoder.SAML2 [4]: searching
metadata for message issuer...
2014-02-21 18:28:30 ERROR OpenSSL [4]: path validation failure at depth(0):
unable to get local issuer certificate
2014-02-21 18:28:30 ERROR OpenSAML.SecurityPolicyRule.XMLSigning [4]:
unable to verify message signature with supplied trust engine

My assumption is that the SP somehow needs to access a root CA certificate.
 Is this assumption correct?  If so how would I do that?

Thanks,

Dan
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20140221/a460652d/attachment.html