"no signing credential resolved, leaving message unsigned"

[Peter Schober]

sacha+shibboleth--- via users <users at shibboleth.net> [2025-06-18 18:43 CEST]:
> Our signing and encryption certificates expired, so the IdP folk asked us to
> replace them. The process was to generate signing and encryption keys, use
> them to generate CSRs, submit them to the IdP people, receive the
> certificates from them, sign and submit a metadata file, then switch things
> over at the IdP and SP ends.

What IDP is this?

FTR, no IDP I know of requires that a Service Provider that allows an
IDP to access its services needs to get its (i.e., the SP's)
certificate signed "by the IDP [people]".

Not only does this not scale, it also doesn't work in the common
deployment of an SP federating with multiple IDPs: How would all IDPs
sign the SP's certificate?
Also, no IDP I know of even cares about the signature on an SP's
certificate because the SP certificate is merely used as a
container/package for the SP's public keys and it's those public keys
that then enable public key cryptography.

So unless this is the most unusual deployment I've ever heard about
none of this should even have been necessary (which is why I'm
mentioning this).

> I'm no OAuth expert but

The Shibboleth SP software does not support OAuth at this time.

I'll have to leave the rest for later or others to comment on.

Best,
-peter