supplied TrustEngine failed to validate SSL/TLS server certificate

[Cantor, Scott]

> I am facing a problem while I am trying to get attributes from the IdP (v3).
> While I can see that the IdP is releasing at least one attribute:

It is not, that's why the SP is querying. You can't fix an attribute release problem by "fixing" the query. The IdP decision is the problem.

> For me the certificate provided in the metadata is correct, the issuer and the
> subjects are OK. Can you please help me to detect where is the problem?

If it's querying, it's looking at an AttributeAuthorityDescriptor in the metadata and whatever key is in there is *not* the key at the TLS endpoint. The certificates have nothing to do with the matter and the issuer certainly doesn't. If you don't understand why, you should read the trust management topics in the wiki. The keys are compared directly, nothing else.

In any event, the IdP's metadata is also wrong, and it probably shouldn't be exposing any support for querying at all.

-- Scott