IdP 3.3.1 SSL certificate signature verification failed

[George Stoynev]

Hello,

while setting up new SP we came across a case very similar to this one: 
http://shibboleth.1660669.n2.nabble.com/SHA1-signed-authn-request-issue-td7631926.html

The precise errors are:
WARN [org.apache.xml.security.signature.XMLSignature:760] - Signature 
verification failed.
ERROR 
[org.opensaml.security.x509.impl.BasicX509CredentialNameEvaluator:300] - 
Credential failed name check:

When ran in debug mode this line comes up as well:
Attempting to retrieve trusted names for  PKIX validation from resolver 
for entity

If I understand this correctly the IdP reads the metadata from the SP 
and tries to verify the certificate against the first one found in that 
metadata. It fails to do so thus falls back to PKIX.

The vendor double checked their side and confirms it is all setup 
correctly.

How could I troubleshoot this further on the IdP end?

According to this answer 
http://shibboleth.1660669.n2.nabble.com/SHA1-signed-authn-request-issue-tp7631926p7631927.html 
either the metadata is wrong or they have the wrong key. How to prove that?

This is the structure of the metadata (filled in with some random values 
for representation purposes):
<md:EntityDescriptor ID="fsdfsdfgsd" cacheDuration="PT1440M" 
entityID="https://example.com">
<ds:Signature>
<ds:SignedInfo>
<ds:CanonicalizationMethod 
Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
<ds:SignatureMethod 
Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/>
<ds:Reference URI="#fzQVcJ3IHi44-FK4SpZ2tS_3vyR"><ds:Transforms>
<ds:Transform 
Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
<ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
</ds:Transforms>
<ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
<ds:DigestValue>fdfsdfdfg=</ds:DigestValue>
</ds:Reference>
</ds:SignedInfo>
<ds:SignatureValue>hgfhgfjgh
</ds:SignatureValue>
<ds:KeyInfo>
<ds:X509Data>
<ds:X509Certificate>bgcgdgdf
</ds:X509Certificate>
</ds:X509Data>
<ds:KeyValue>
<ds:RSAKeyValue>
<ds:Modulus>yuiyuioyu
</ds:Modulus>
<ds:Exponent>AQAB
</ds:Exponent>
</ds:RSAKeyValue>
</ds:KeyValue>
</ds:KeyInfo>
</ds:Signature>
<md:SPSSODescriptor 
protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol" 
WantAssertionsSigned="false" AuthnRequestsSigned="true">
<md:KeyDescriptor use="signing">
<ds:KeyInfo>
<ds:X509Data>
<ds:X509Certificate>dfgdfgsf
</ds:X509Certificate>
</ds:X509Data>
</ds:KeyInfo>
</md:KeyDescriptor>
<md:SingleLogoutService 
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" 
Location="https://example.com/sp/SLO.saml2"/>
<md:SingleLogoutService 
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" 
Location="https://example.com/sp/SLO.saml2"/>
<md:AssertionConsumerService index="0" 
Location="https://example.com/sp/ACS.saml2" 
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" isDefault="true"/>
</md:SPSSODescriptor>
</md:EntityDescriptor>

Thank you,

George