IdP 3.3.1 SSL certificate signature verification failed

[George Stoynev]

Thank you Scott!

If the certificate is self-signed would this have any impact on the 
signature verification? I think it should not as long as the key in the 
metadata is correct.

How to verify if the metadata is wrong? What is the most likely reason 
for a metadata to be incorrect?

I would like to learn more about this in order to point the vendor in 
the right direction.

Thank you again,

George

On 2017-07-05 10:07 AM, users-request at shibboleth.net wrote:
>     2. Re: IdP 3.3.1 SSL certificate signature verification failed
>        (Cantor, Scott)
>
>
> ----------------------------------------------------------------------
>
> Message: 2
> Date: Wed, 5 Jul 2017 14:06:56 +0000
> From: "Cantor, Scott" <cantor.2 at osu.edu>
> To: Shib Users <users at shibboleth.net>
> Subject: Re: IdP 3.3.1 SSL certificate signature verification failed
> Message-ID: <73FA1309-6E6B-4782-9AA7-2A828C340D1D at osu.edu>
> Content-Type: text/plain; charset="utf-8"
>
> On 7/4/17, 11:27 AM, "users on behalf of George Stoynev" <users-bounces at shibboleth.net on behalf of george.stoynev at mcgill.ca> wrote:
>
>> If I understand this correctly the IdP reads the metadata from the SP
>> and tries to verify the certificate against the first one found in that
>> metadata. It fails to do so thus falls back to PKIX.
> Correct, except it's not verifying the certificate, it's verifying the key in the certificate. The content of the certificate is ignored.
>
>> The vendor double checked their side and confirms it is all setup
>> correctly.
> Then the metadata's wrong I suppose.
>
>> How could I troubleshoot this further on the IdP end?
> You can't, there really isn't anything else to troubleshoot, the cause is either that, or they have a bug in their code in the first place.
>
> You can't ever know that the vendor is giving you the right key. You might have a clue that it's not if it's a commercial TLS certificate, but even that's not a guarantee that it's wrong, it just means you're screwed either way since they'll probably change the key on you improperly at some point later.
>
> -- Scott
>
>
>
> ------------------------------
>
> Subject: Digest Footer
>
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
>
> ------------------------------
>
> End of users Digest, Vol 73, Issue 11
> *************************************