Multiple Logic SP's -- assertion decrypting failed

[joller lee]

I've deployed an SP without any problem for quite a while.
Now I am trying to configure a "logical SP's" on the same physical SP
installation,
with a new vhost that is only different on the port number.
The metadata for the new logical SP is created by simply copying the
original one
and modifying the entityID and endpoints, which means the same key pair is
used.
Also in the ApplicationOverride setting, the same pair of key/cert files
are used.
(In fact, I believe CredentialResolver can be ignored here, thanks to
inheritance)

Their entityID's are as follow:

    the original: https://my.host.name/shibboleth
    the new one: https://my.host.name/shibboleth/app1

The original SP still works well.
But with the new one, I encounter a problem:
After a valid authentication process, the IdP sends back the assertion,
but the new logical SP fails to decrypt it, with the following error
message:

    failed to decrypt assertion: Unable to locate an encrypted key.

Just in case, I've tried analyzing the certificate, and there is a
statement:

X509v3 extensions:
            X509v3 Subject Alternative Name:
                DNS:zimbra.ntin.edu.tw, URI:https://my.host.name/shibboleth

Has anyone encountered the same problem before?
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160317/a758eb32/attachment.html>