Certificate Load Issue within Java / Shibboleth 3.2.1

[Reid Watson]

Hi Everyone 

We just received the new metadata from the vendor but when shibboleth attempted to sign the request it couldn’t process the certificate 

Metadata Location: http://blogs.auckland.ac.nz/Shibboleth.sso/Metadata

-----BEGIN CERTIFICATE REQUEST-----
MIIDWjCCAuCgAwIBAgIJAJMrhqxvtKGaMAoGCCqGSM49BAMCMDkxNzA1BgNVBAMT
LnNlY3VyZS1hcC1zb3V0aGVhc3QtMi5jYW1wdXMuYXV0aC5lZHVibG9ncy5vcmcw
HhcNMTcwMTE0MDg1ODUzWhcNMjcwMTEyMDg1ODUzWjA5MTcwNQYDVQQDEy5zZWN1
cmUtYXAtc291dGhlYXN0LTIuY2FtcHVzLmF1dGguZWR1YmxvZ3Mub3JnMIIBzDCC
AWQGByqGSM49AgEwggFXAgEBMDwGByqGSM49AQECMQD/////////////////////
/////////////////////v////8AAAAAAAAAAP////8wewQw////////////////
//////////////////////////7/////AAAAAAAAAAD////8BDCzMS+n4j7n5JiO
BWvj+C0ZGB2cbv6BQRIDFAiPUBOHWsZWOY2KLtGdKoXI7dPsKu8DFQCjNZJqoxmi
eh0AiWpnc6SCes2scwRhBKqHyiK+iwU3jrHHHvMgrXRuHTtii6ebmFn3QeCCVCo4
VQLyXb9VKWw6VF44cnYKtzYX3kqWJixvXZ6Yv5KS3Cn49B29KJoUfOnaMRO18LjA
CmCxzh1+gZ16Qx18kOoOXwIxAP///////////////////////////////8djTYH0
Ny3fWBoNskiwp3rs7BlqzMUpcwIBAQNiAAS7/PjocMwzBaxY4W9W6IG4bcvL0FYO
WVbGkkGghbhYP+i7SQrSEIMy12KLOIgIlmIC8MwSMzIiEYrPo6IhbRrlcy3/6GG9
piNN2cnOgszHLlwGjcCOleBSECjmdv1W3JWjXDBaMDkGA1UdEQQyMDCCLnNlY3Vy
ZS1hcC1zb3V0aGVhc3QtMi5jYW1wdXMuYXV0aC5lZHVibG9ncy5vcmcwHQYDVR0O
BBYEFNYGWvJFRtNVDeAEfAKe/vXkPe3+MAoGCCqGSM49BAMCA2gAMGUCMQDoXSr5
oxc3eO2hALyS+43E4bRz3loZSkM6Gcsr97+whiHhURNgDgGZTpleAJ6b7KACMHbo
J973ocItHFrb3oeSkE7w724yvJipxAsvdxvniaXQjOl8rIToIdh0Qo45nqPLZg==
-----END CERTIFICATE REQUEST——


- Key-Size	EC 384 bits
- Signature Algorithm	Strong (ecdsa-with-SHA256)

Shibboleth Error 

2017-07-25 13:53:16,708 - ERROR [org.opensaml.xmlsec.keyinfo.impl.provider.InlineX509DataProvider:191] - Error extracting certificates from X509Data
java.security.cert.CertificateException: java.lang.IllegalArgumentException: Error reading certificate
        at org.opensaml.security.x509.X509Support.decodeCertificate(X509Support.java:357)
Caused by: java.lang.IllegalArgumentException: Error reading certificate
        at org.cryptacular.util.CertUtil.readCertificate(CertUtil.java:245)
Caused by: java.security.cert.CertificateParsingException: java.io.IOException: Only named ECParameters supported
        at sun.security.x509.X509CertInfo.<init>(X509CertInfo.java:169)
Caused by: java.io.IOException: Only named ECParameters supported
        at sun.security.ec.ECParameters.engineInit(ECParameters.java:150)
2017-07-25 13:53:16,725 - WARN [org.opensaml.saml.common.binding.security.impl.BaseSAMLSimpleSignatureSecurityHandler:291] - Message Handler:  Error evaluating the request's simple signature using the trust engine
org.opensaml.security.SecurityException: Error resolving trusted credentials
        at org.opensaml.xmlsec.signature.support.impl.ExplicitKeySignatureTrustEngine.doValidate(ExplicitKeySignatureTrustEngine.java:147)
Caused by: net.shibboleth.utilities.java.support.resolver.ResolverException: Error processing KeyInfo child element
        at org.opensaml.xmlsec.keyinfo.impl.BasicProviderKeyInfoCredentialResolver.processKeyInfoChild(BasicProviderKeyInfoCredentialResolver.java:322)
Caused by: org.opensaml.security.SecurityException: Error extracting certificates from X509Data
        at org.opensaml.xmlsec.keyinfo.impl.provider.InlineX509DataProvider.extractCertificates(InlineX509DataProvider.java:192)
Caused by: java.security.cert.CertificateException: java.lang.IllegalArgumentException: Error reading certificate
        at org.opensaml.security.x509.X509Support.decodeCertificate(X509Support.java:357)
Caused by: java.lang.IllegalArgumentException: Error reading certificate
        at org.cryptacular.util.CertUtil.readCertificate(CertUtil.java:245)
Caused by: java.security.cert.CertificateParsingException: java.io.IOException: Only named ECParameters supported
        at sun.security.x509.X509CertInfo.<init>(X509CertInfo.java:169)
Caused by: java.io.IOException: Only named ECParameters supported
        at sun.security.ec.ECParameters.engineInit(ECParameters.java:150)


- Workaround: Manually updated the metadata (removing the certificate) and shibboleth reloaded the metadata correctly 
- I have already loaded “Java Cryptography Extension (JCE) Unlimited Strength Jurisdiction Policy"

http://www.oracle.com/technetwork/java/javase/downloads/jce8-download-2133166.html

Any advice ?