SAML1

[Rod Widdowson]

How is the 8443 channel on your IdP configured?

Are you behind Apache?  Tomcat?  Have you configured the usual "no trust
check"  stuff on that connector?
(https://wiki.shibboleth.net/confluence/display/SHIB2/IdPApacheTomcatPrepare
https://wiki.shibboleth.net/confluence/display/SHIB2/IdPJetty7Prepare
https://wiki.shibboleth.net/confluence/display/IDP30/Jetty9
https://wiki.shibboleth.net/confluence/display/IDP30/ApacheTomcat8)

This looks like the usual case when the IdP isn't prepared to accept the SP
certificate presented with the connection.

I cannot immediately see from your log if you are IdP2 or 3, but that’s
irrelevant if it is a container issue.  Are there any container log
messages?

/R