IdP 3.3.1 SSL certificate signature verification failed

[Cantor, Scott]

On 7/4/17, 11:27 AM, "users on behalf of George Stoynev" <users-bounces at shibboleth.net on behalf of george.stoynev at mcgill.ca> wrote:

> If I understand this correctly the IdP reads the metadata from the SP 
> and tries to verify the certificate against the first one found in that 
> metadata. It fails to do so thus falls back to PKIX.

Correct, except it's not verifying the certificate, it's verifying the key in the certificate. The content of the certificate is ignored.

> The vendor double checked their side and confirms it is all setup 
> correctly.

Then the metadata's wrong I suppose.

> How could I troubleshoot this further on the IdP end?

You can't, there really isn't anything else to troubleshoot, the cause is either that, or they have a bug in their code in the first place.

You can't ever know that the vendor is giving you the right key. You might have a clue that it's not if it's a commercial TLS certificate, but even that's not a guarantee that it's wrong, it just means you're screwed either way since they'll probably change the key on you improperly at some point later.

-- Scott