Budh, I think there’s a pretty good chance that you’re trying to validate InCommon’s signature using your certificate or an empty file. I would expect that to fail. > <MetadataFilter type="Signature" certificate="accounts400_idp_cert.pem"/> Hope this helps, Nate.