Shibboleth Idp 2.4.0 - Having issues changing Metadata

[Ben Branch]

All,

This is my very first Shibboleth installation and I had it working fine as of about 5 hours ago.  I had it working against the Testshib.org website without any issues.  I had been struggling to understand what people meant by "Updating the Metadata".  I googled and googled till I finally found a site that discussed updating Idp metadata.  So, I did the following:

Made a backup of the /opt/shibboleth-idp/metadata/idp-metadata.xml
Made backups of the /opt/shibboleth-idp/credentials files (idp.crt, idp.key, and idp,jks).

Used the following to create a new X509 certificate/key:

# cat > idp-cert.cnf <<EOF
[req]
prompt=no
default_bits=2048
encrypt_key=no
default_md=sha1
distinguished_name=dn
# PrintableStrings only
string_mask=MASK:0002
x509_extensions=ext
[dn]
CN=casdev.uco.edu
[ext]
subjectAltName=DNS:casdev.uco.edu,URI:https://casdev.uco.edu/idp/shibboleth
subjectKeyIdentifier=hash
EOF

openssl req -config idp-cert.cnf -new -x509 -keyout idp.new.key -out idp.new.crt 2> /dev/null

After creating the new crt and key files, I copied them into the /opt/shibboleth-idp/credentials directory and renamed them to the right names and double checked ownership of the files.   After renaming them, I did a "cat idp.crt" to get the X509 key and put that into my /opt/shibboleth-idp/metadata/idp-metadata.xml.  I then uploaded my metadata to testshib.org to test and see if my new certs are working and now I am getting the following error messages in their log:

2014-07-08 14:29:42 ERROR OpenSAML.SecurityPolicyRule.XMLSigning [245]: unable to verify message signature with supplied trust engine
2014-07-08 14:29:42 WARN Shibboleth.SSO.SAML2 [245]: detected a problem with assertion: Message was signed, but signature could not be verified.

Additionally, I used the ./install.sh renew-cert to do this exact same thing, and I am still getting the same error message from testshib.org and I have uploaded the metadata file multiple times now with no luck.  Is there something I'm missing?  Or am I just being stupid and missing the obvious?

Ben Branch
UNIX/Linux Administrator
University of Central Oklahoma
ITIL Foundation v3, Network+, RHCSA

100 N. University Drive, Box 122
Edmond, OK 73034
D: 405.974.2649 | M: 405.550.6804 | bbranch at uco.<mailto:bbranch at uco.>edu | www.uco.edu<http://www.uco.edu/>

"I am wiser than this man, for neither of us appears to know anything great and good; but he fancies he knows something, although he knows nothing; whereas I, as I do not know anything, so I do not fancy I do. In this trifling particular, then, I appear to be wiser than he, because I do not fancy I know what I do not know."  - Socrates

**Bronze+Blue=Green** The University of Central Oklahoma is Bronze, Blue, and Green! Please print this e-mail only if absolutely necessary!

**CONFIDENTIALITY** -This e-mail (including any attachments) may contain confidential, proprietary and privileged information. Any unauthorized disclosure or use of this information is prohibited.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20140708/f0ab6bb6/attachment-0001.html