IdP 2.4.4 won't load DER keypair

[Tom Poage]

Evening,

Trying to configure IdP 2.4.4 and it will not load the following keypair:

<security:Credential id="MyCredential" xsi:type="security:BasicFilesystem">
    <security:PrivateKey>/ucd/opt/shibboleth-idp/credentials/dsaprivkey.der</security:PrivateKey>
    <security:PublicKey>/ucd/opt/shibboleth-idp/credentials/dsapubkey.der</security:PublicKey>
</security:Credential>

This has been used for a number of years for a non-encrypted-but-signed relying party:

<rp:RelyingParty id="MyMDGroup"
    provider="MyentityID"
    defaultSigningCredentialRef="MyCredential">
        <rp:ProfileConfiguration xsi:type="saml:SAML2SSOProfile" encryptAssertions="never"/>
</rp:RelyingParty>

shibboleth-2.0-security.xsd in the .war suggests this Credential configuration is still supported.

idp-process.log shows:

> 22:32:49.978 - INFO [edu.internet2.middleware.shibboleth.common.config.security.AbstractBasicCredentialBeanDefinitionParser:60] - Parsing configuration for BasicFiles
> ystem credential with id: MyCredential
> 22:32:49.979 - DEBUG [edu.internet2.middleware.shibboleth.common.config.security.AbstractCredentialBeanDefinitionParser:92] - Parsing credential key names
> 22:32:49.979 - DEBUG [edu.internet2.middleware.shibboleth.common.config.security.AbstractCredentialBeanDefinitionParser:122] - Parsing credential private key
> 22:32:49.982 - DEBUG [edu.internet2.middleware.shibboleth.common.config.security.AbstractBasicCredentialBeanDefinitionParser:119] - Parsing credential public key
> 22:32:49.983 - ERROR [edu.internet2.middleware.shibboleth.common.config.BaseService:188] - Configuration was not loaded for shibboleth.RelyingPartyConfigurationManage
> r service, error creating components.  The root cause of this error was: java.lang.NullPointerException: null
> 22:32:49.998 - ERROR [edu.internet2.middleware.shibboleth.common.config.BaseReloadableService:197] - Error reloading configuration, upon configuration resource update
> , for service shibboleth.RelyingPartyConfigurationManager
> edu.internet2.middleware.shibboleth.common.service.ServiceException: Configuration was not loaded for shibboleth.RelyingPartyConfigurationManager service, error creat
> ing components.
>         at edu.internet2.middleware.shibboleth.common.config.BaseService.loadContext(BaseService.java:192) ~[shibboleth-common-1.4.4.jar:na]
>         at edu.internet2.middleware.shibboleth.common.config.BaseReloadableService$ConfigurationResourceListener.onResourceUpdate(BaseReloadableService.java:195) ~[sh
> ibboleth-common-1.4.4.jar:na]
>         at org.opensaml.util.resource.ResourceChangeWatcher.signalListeners(ResourceChangeWatcher.java:206) [openws-1.5.5.jar:na]
>         at org.opensaml.util.resource.ResourceChangeWatcher.run(ResourceChangeWatcher.java:167) [openws-1.5.5.jar:na]

Suggestions? Convert public key to some other format?

Behavior the same whether the public key is in DER or PEM format.

WAG, something introduced with the 2.4.x branch? SC-191?

If you must know, it's for Google Apps.

Note: Now it seems if I simply base-64 encode the DER public key (no PEM 'wrapper'), the key pair seems to load (not tested for function just yet), so now I'm left slightly astonished, but at least not completely perplexed. :-)

Thanks.
Tom.