metadata.xml not generating with certificate information

[Peter Schober]

* Alvin Leung <alvin at lotj.com> [2017-12-13 23:13]:
> There is a X509 certificate installed on both the ELB and on the Web
> Server. When we attempt the generate the metadata by going to
> https://xxx/Shibboleth.sso/Metadata the metadata that we receive
> does not contain any certificate information, resulting in the IDP
> not being able to encrypt the assertion.

The Shib SP does not use your TLS key pair to secure SAML protocol
messages by default, and you should not configure it do to so.
Instead another key pair is created solely for SAML purposes and fully
independent of any web server or TLS keys.

On supported platforms the SP RPM's post-install script automatically
runs the distributed /etc/shibboleth/keygen.sh script to generate a
usable and appropriate key pair on your server, by default as
/etc/shibboleth/sp-{cert,key}.pem files.
(On Debian it's called shib-keygen and in the $PATH for root.)

Also by default the SP would then reference this key pair in its
default shibboleth2.xml configuration and finally would also (again,
by default) generate SAML Metadata about itself including the public
key of that key pair.

So if that key pair doesn't exist in your deployment someone might
have renamed or removed that. Also check what key your shibboleth2.xml
references, if any.

> Is there a way for us to be able to generate the metadata with the
> certificate information?

By creating a/the key pair the RPM installer would have run on
RHEL/CentOS and by making sure its referenced correcly in the
configuration, plus file system permissions, of course.

-peter