<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">
Yaowen,
<div><br>
</div>
<div>They have the same public key:</div>
<div><br>
</div>
<div>
<div>Certificate:</div>
<div> Data:</div>
<div> Version: 3 (0x2)</div>
<div> Serial Number: 0 (0x0)</div>
<div> Signature Algorithm: sha1WithRSAEncryption</div>
<div> Issuer: C=US, ST=Pennsylvania, L=Pittsburgh, O=TestShib, CN=idp.testshib.org</div>
<div> Validity</div>
<div> Not Before: Aug 30 21:12:25 2006 GMT</div>
<div> Not After : Aug 27 21:12:25 2016 GMT</div>
<div> Subject: C=US, ST=Pennsylvania, L=Pittsburgh, O=TestShib, CN=idp.testshib.org</div>
<div> Subject Public Key Info:</div>
<div> Public Key Algorithm: rsaEncryption</div>
<div> Public-Key: (2048 bit)</div>
<div> Modulus:</div>
<div> 00:ad:89:02:1a:e4:e6:26:9f:5e:00:e4:86:1f:04:</div>
<div> 49:a3:54:8d:6a:d0:79:64:e2:aa:0c:cf:72:b2:0e:</div>
<div> c2:c9:54:c3:0a:57:29:bb:dd:e0:48:fd:74:9c:7e:</div>
<div> 20:90:26:4e:96:71:12:36:0b:6d:83:4a:fe:32:a2:</div>
<div> fc:b5:f2:42:eb:26:dd:74:41:41:dd:80:68:f0:f6:</div>
<div> 5a:8c:a4:9e:dc:e4:34:d4:ec:37:c9:3e:08:f9:67:</div>
<div> 60:d6:db:13:a5:28:1e:f6:01:33:ed:2a:c2:d3:b1:</div>
<div> 24:62:61:ee:3e:d7:7b:d4:21:e2:51:a0:96:0e:ff:</div>
<div> b1:55:f5:10:5f:46:93:34:f1:66:0e:2c:73:52:3a:</div>
<div> 18:cd:b1:83:ae:d0:32:0a:a0:3c:7f:d0:8d:da:dc:</div>
<div> 48:7c:99:e9:1c:4e:aa:e8:29:8a:72:82:c0:0d:2e:</div>
<div> 14:ac:d3:e5:84:74:b3:77:ad:78:91:1f:c9:62:29:</div>
<div> 2c:d0:ae:24:6d:1a:82:40:5d:03:bf:43:f9:0e:2f:</div>
<div> ab:11:f7:9f:0b:a8:25:57:cc:ac:0b:c7:41:e7:ff:</div>
<div> 67:6f:4c:a1:fe:88:d1:b8:91:a6:80:c5:87:81:69:</div>
<div> 3a:87:48:a1:8e:28:6a:8a:ee:23:00:2a:2f:51:9e:</div>
<div> ef:54:e0:a0:48:4e:48:a6:7e:ce:23:0a:9d:f7:7c:</div>
<div> e9:db</div>
<div> Exponent: 65537 (0x10001)</div>
<div> X509v3 extensions:</div>
<div> X509v3 Subject Key Identifier: </div>
<div> AC:05:0F:3A:F6:78:7C:DC:AA:99:AF:98:C0:AE:BE:3F:ED:BF:90:6B</div>
<div> X509v3 Authority Key Identifier: </div>
<div> keyid:AC:05:0F:3A:F6:78:7C:DC:AA:99:AF:98:C0:AE:BE:3F:ED:BF:90:6B</div>
<div> DirName:/C=US/ST=Pennsylvania/L=Pittsburgh/O=TestShib/CN=idp.testshib.org</div>
<div> serial:00</div>
<div><br>
</div>
<div> X509v3 Basic Constraints: </div>
<div> CA:TRUE</div>
<div> Signature Algorithm: sha1WithRSAEncryption</div>
<div> 8d:1d:bd:3e:1a:c2:6e:4f:2a:2c:de:4c:15:f4:95:93:df:2d:</div>
<div> dc:24:fd:8c:76:68:63:17:7c:40:c4:4b:23:88:fb:89:84:31:</div>
<div> 5e:21:89:4d:3d:45:5e:cd:67:77:84:61:6b:db:a7:f8:ba:93:</div>
<div> 7d:e3:0c:62:a2:12:74:30:c8:ea:db:fc:88:da:64:38:0b:d9:</div>
<div> 65:4a:2c:56:45:28:f7:7a:6f:d5:3d:11:3f:3d:f9:85:c1:c7:</div>
<div> 62:ad:b2:79:ee:7d:1c:93:9c:a3:66:c5:95:cb:07:f0:90:57:</div>
<div> 45:24:6b:27:74:3b:12:eb:7e:cf:db:a8:f3:42:5d:18:d2:78:</div>
<div> fd:22:72:e5:4a:2b:67:c2:9a:cc:68:f5:ea:57:c9:84:e0:57:</div>
<div> 95:d8:2b:86:9a:50:05:bd:0d:ab:a1:ca:1e:0b:aa:9b:04:5f:</div>
<div> 27:e5:a4:c5:e9:99:5f:38:5e:76:20:23:19:e9:1a:f2:7c:fc:</div>
<div> 26:3c:31:a5:48:c0:89:25:98:28:bb:49:84:61:1a:4e:a0:98:</div>
<div> c4:20:97:d8:3c:3e:74:e4:ea:53:31:ce:67:b5:8a:bf:82:57:</div>
<div> 3c:ae:46:fd:48:6b:f0:af:ea:86:61:53:da:72:10:8b:9d:fc:</div>
<div> 9f:aa:d5:60:b7:96:8f:c0:5b:9e:5f:9e:bf:4a:5e:63:3c:45:</div>
<div> c8:5e:6c:40</div>
<div>-----BEGIN CERTIFICATE-----</div>
<div>MIIEDjCCAvagAwIBAgIBADANBgkqhkiG9w0BAQUFADBnMQswCQYDVQQGEwJVUzEV</div>
<div>MBMGA1UECBMMUGVubnN5bHZhbmlhMRMwEQYDVQQHEwpQaXR0c2J1cmdoMREwDwYD</div>
<div>VQQKEwhUZXN0U2hpYjEZMBcGA1UEAxMQaWRwLnRlc3RzaGliLm9yZzAeFw0wNjA4</div>
<div>MzAyMTEyMjVaFw0xNjA4MjcyMTEyMjVaMGcxCzAJBgNVBAYTAlVTMRUwEwYDVQQI</div>
<div>EwxQZW5uc3lsdmFuaWExEzARBgNVBAcTClBpdHRzYnVyZ2gxETAPBgNVBAoTCFRl</div>
<div>c3RTaGliMRkwFwYDVQQDExBpZHAudGVzdHNoaWIub3JnMIIBIjANBgkqhkiG9w0B</div>
<div>AQEFAAOCAQ8AMIIBCgKCAQEArYkCGuTmJp9eAOSGHwRJo1SNatB5ZOKqDM9ysg7C</div>
<div>yVTDClcpu93gSP10nH4gkCZOlnESNgttg0r+MqL8tfJC6ybddEFB3YBo8PZajKSe</div>
<div>3OQ01Ow3yT4I+Wdg1tsTpSge9gEz7SrC07EkYmHuPtd71CHiUaCWDv+xVfUQX0aT</div>
<div>NPFmDixzUjoYzbGDrtAyCqA8f9CN2txIfJnpHE6q6CmKcoLADS4UrNPlhHSzd614</div>
<div>kR/JYiks0K4kbRqCQF0Dv0P5Di+rEfefC6glV8ysC8dB5/9nb0yh/ojRuJGmgMWH</div>
<div>gWk6h0ihjihqiu4jACovUZ7vVOCgSE5Ipn7OIwqd93zp2wIDAQABo4HEMIHBMB0G</div>
<div>A1UdDgQWBBSsBQ869nh83KqZr5jArr4/7b+QazCBkQYDVR0jBIGJMIGGgBSsBQ86</div>
<div>9nh83KqZr5jArr4/7b+Qa6FrpGkwZzELMAkGA1UEBhMCVVMxFTATBgNVBAgTDFBl</div>
<div>bm5zeWx2YW5pYTETMBEGA1UEBxMKUGl0dHNidXJnaDERMA8GA1UEChMIVGVzdFNo</div>
<div>aWIxGTAXBgNVBAMTEGlkcC50ZXN0c2hpYi5vcmeCAQAwDAYDVR0TBAUwAwEB/zAN</div>
<div>BgkqhkiG9w0BAQUFAAOCAQEAjR29PhrCbk8qLN5MFfSVk98t3CT9jHZoYxd8QMRL</div>
<div>I4j7iYQxXiGJTT1FXs1nd4Rha9un+LqTfeMMYqISdDDI6tv8iNpkOAvZZUosVkUo</div>
<div>93pv1T0RPz35hcHHYq2yee59HJOco2bFlcsH8JBXRSRrJ3Q7Eut+z9uo80JdGNJ4</div>
<div>/SJy5UorZ8KazGj16lfJhOBXldgrhppQBb0Nq6HKHguqmwRfJ+WkxemZXzhediAj</div>
<div>Geka8nz8JjwxpUjAiSWYKLtJhGEaTqCYxCCX2Dw+dOTqUzHOZ7WKv4JXPK5G/Uhr</div>
<div>8K/qhmFT2nIQi538n6rVYLeWj8Bbnl+ev0peYzxFyF5sQA==</div>
<div>-----END CERTIFICATE-----</div>
</div>
<div><br>
</div>
<div>
<div>Certificate:</div>
<div> Data:</div>
<div> Version: 3 (0x2)</div>
<div> Serial Number: 0 (0x0)</div>
<div> Signature Algorithm: sha1WithRSAEncryption</div>
<div> Issuer: C=US, ST=Pennsylvania, L=Pittsburgh, O=TestShib, CN=idp.testshib.org</div>
<div> Validity</div>
<div> Not Before: Aug 30 21:12:25 2006 GMT</div>
<div> Not After : Aug 27 21:12:25 2016 GMT</div>
<div> Subject: C=US, ST=Pennsylvania, L=Pittsburgh, O=TestShib, CN=idp.testshib.org</div>
<div> Subject Public Key Info:</div>
<div> Public Key Algorithm: rsaEncryption</div>
<div> Public-Key: (2048 bit)</div>
<div> Modulus:</div>
<div> 00:ad:89:02:1a:e4:e6:26:9f:5e:00:e4:86:1f:04:</div>
<div> 49:a3:54:8d:6a:d0:79:64:e2:aa:0c:cf:72:b2:0e:</div>
<div> c2:c9:54:c3:0a:57:29:bb:dd:e0:48:fd:74:9c:7e:</div>
<div> 20:90:26:4e:96:71:12:36:0b:6d:83:4a:fe:32:a2:</div>
<div> fc:b5:f2:42:eb:26:dd:74:41:41:dd:80:68:f0:f6:</div>
<div> 5a:8c:a4:9e:dc:e4:34:d4:ec:37:c9:3e:08:f9:67:</div>
<div> 60:d6:db:13:a5:28:1e:f6:01:33:ed:2a:c2:d3:b1:</div>
<div> 24:62:61:ee:3e:d7:7b:d4:21:e2:51:a0:96:0e:ff:</div>
<div> b1:55:f5:10:5f:46:93:34:f1:66:0e:2c:73:52:3a:</div>
<div> 18:cd:b1:83:ae:d0:32:0a:a0:3c:7f:d0:8d:da:dc:</div>
<div> 48:7c:99:e9:1c:4e:aa:e8:29:8a:72:82:c0:0d:2e:</div>
<div> 14:ac:d3:e5:84:74:b3:77:ad:78:91:1f:c9:62:29:</div>
<div> 2c:d0:ae:24:6d:1a:82:40:5d:03:bf:43:f9:0e:2f:</div>
<div> ab:11:f7:9f:0b:a8:25:57:cc:ac:0b:c7:41:e7:ff:</div>
<div> 67:6f:4c:a1:fe:88:d1:b8:91:a6:80:c5:87:81:69:</div>
<div> 3a:87:48:a1:8e:28:6a:8a:ee:23:00:2a:2f:51:9e:</div>
<div> ef:54:e0:a0:48:4e:48:a6:7e:ce:23:0a:9d:f7:7c:</div>
<div> e9:db</div>
<div> Exponent: 65537 (0x10001)</div>
<div> X509v3 extensions:</div>
<div> X509v3 Subject Key Identifier: </div>
<div> AC:05:0F:3A:F6:78:7C:DC:AA:99:AF:98:C0:AE:BE:3F:ED:BF:90:6B</div>
<div> X509v3 Authority Key Identifier: </div>
<div> keyid:AC:05:0F:3A:F6:78:7C:DC:AA:99:AF:98:C0:AE:BE:3F:ED:BF:90:6B</div>
<div> DirName:/C=US/ST=Pennsylvania/L=Pittsburgh/O=TestShib/CN=idp.testshib.org</div>
<div> serial:00</div>
<div><br>
</div>
<div> X509v3 Basic Constraints: </div>
<div> CA:TRUE</div>
<div> Signature Algorithm: sha1WithRSAEncryption</div>
<div> 8d:1d:bd:3e:1a:c2:6e:4f:2a:2c:de:4c:15:f4:95:93:df:2d:</div>
<div> dc:24:fd:8c:76:68:63:17:7c:40:c4:4b:23:88:fb:89:84:31:</div>
<div> 5e:21:89:4d:3d:45:5e:cd:67:77:84:61:6b:db:a7:f8:ba:93:</div>
<div> 7d:e3:0c:62:a2:12:74:30:c8:ea:db:fc:88:da:64:38:0b:d9:</div>
<div> 65:4a:2c:56:45:28:f7:7a:6f:d5:3d:11:3f:3d:f9:85:c1:c7:</div>
<div> 62:ad:b2:79:ee:7d:1c:93:9c:a3:66:c5:95:cb:07:f0:90:57:</div>
<div> 45:24:6b:27:74:3b:12:eb:7e:cf:db:a8:f3:42:5d:18:d2:78:</div>
<div> fd:22:72:e5:4a:2b:67:c2:9a:cc:68:f5:ea:57:c9:84:e0:57:</div>
<div> 95:d8:2b:86:9a:50:05:bd:0d:ab:a1:ca:1e:0b:aa:9b:04:5f:</div>
<div> 27:e5:a4:c5:e9:99:5f:38:5e:76:20:23:19:e9:1a:f2:7c:fc:</div>
<div> 26:3c:31:a5:48:c0:89:25:98:28:bb:49:84:61:1a:4e:a0:98:</div>
<div> c4:20:97:d8:3c:3e:74:e4:ea:53:31:ce:67:b5:8a:bf:82:57:</div>
<div> 3c:ae:46:fd:48:6b:f0:af:ea:86:61:53:da:72:10:8b:9d:fc:</div>
<div> 9f:aa:d5:60:b7:96:8f:c0:5b:9e:5f:9e:bf:4a:5e:63:3c:45:</div>
<div> c8:5e:6c:40</div>
<div>-----BEGIN CERTIFICATE-----</div>
<div>MIIEDjCCAvagAwIBAgIBADANBgkqhkiG9w0BAQUFADBnMQswCQYDVQQGEwJVUzEV</div>
<div>MBMGA1UECBMMUGVubnN5bHZhbmlhMRMwEQYDVQQHEwpQaXR0c2J1cmdoMREwDwYD</div>
<div>VQQKEwhUZXN0U2hpYjEZMBcGA1UEAxMQaWRwLnRlc3RzaGliLm9yZzAeFw0wNjA4</div>
<div>MzAyMTEyMjVaFw0xNjA4MjcyMTEyMjVaMGcxCzAJBgNVBAYTAlVTMRUwEwYDVQQI</div>
<div>EwxQZW5uc3lsdmFuaWExEzARBgNVBAcTClBpdHRzYnVyZ2gxETAPBgNVBAoTCFRl</div>
<div>c3RTaGliMRkwFwYDVQQDExBpZHAudGVzdHNoaWIub3JnMIIBIjANBgkqhkiG9w0B</div>
<div>AQEFAAOCAQ8AMIIBCgKCAQEArYkCGuTmJp9eAOSGHwRJo1SNatB5ZOKqDM9ysg7C</div>
<div>yVTDClcpu93gSP10nH4gkCZOlnESNgttg0r+MqL8tfJC6ybddEFB3YBo8PZajKSe</div>
<div>3OQ01Ow3yT4I+Wdg1tsTpSge9gEz7SrC07EkYmHuPtd71CHiUaCWDv+xVfUQX0aT</div>
<div>NPFmDixzUjoYzbGDrtAyCqA8f9CN2txIfJnpHE6q6CmKcoLADS4UrNPlhHSzd614</div>
<div>kR/JYiks0K4kbRqCQF0Dv0P5Di+rEfefC6glV8ysC8dB5/9nb0yh/ojRuJGmgMWH</div>
<div>gWk6h0ihjihqiu4jACovUZ7vVOCgSE5Ipn7OIwqd93zp2wIDAQABo4HEMIHBMB0G</div>
<div>A1UdDgQWBBSsBQ869nh83KqZr5jArr4/7b+QazCBkQYDVR0jBIGJMIGGgBSsBQ86</div>
<div>9nh83KqZr5jArr4/7b+Qa6FrpGkwZzELMAkGA1UEBhMCVVMxFTATBgNVBAgTDFBl</div>
<div>bm5zeWx2YW5pYTETMBEGA1UEBxMKUGl0dHNidXJnaDERMA8GA1UEChMIVGVzdFNo</div>
<div>aWIxGTAXBgNVBAMTEGlkcC50ZXN0c2hpYi5vcmeCAQAwDAYDVR0TBAUwAwEB/zAN</div>
<div>BgkqhkiG9w0BAQUFAAOCAQEAjR29PhrCbk8qLN5MFfSVk98t3CT9jHZoYxd8QMRL</div>
<div>I4j7iYQxXiGJTT1FXs1nd4Rha9un+LqTfeMMYqISdDDI6tv8iNpkOAvZZUosVkUo</div>
<div>93pv1T0RPz35hcHHYq2yee59HJOco2bFlcsH8JBXRSRrJ3Q7Eut+z9uo80JdGNJ4</div>
<div>/SJy5UorZ8KazGj16lfJhOBXldgrhppQBb0Nq6HKHguqmwRfJ+WkxemZXzhediAj</div>
<div>Geka8nz8JjwxpUjAiSWYKLtJhGEaTqCYxCCX2Dw+dOTqUzHOZ7WKv4JXPK5G/Uhr</div>
<div>8K/qhmFT2nIQi538n6rVYLeWj8Bbnl+ev0peYzxFyF5sQA==</div>
<div>-----END CERTIFICATE-----</div>
</div>
<div><br>
</div>
<div>I'm not sure why it would be using the second certificate to sign messages to you, though. It's not used in other transactions from what I can tell. It is configured into the IdP as part of an old certificate rollover.</div>
<div><br>
</div>
<div>I've commented out the certificate that I believe is leftover. You can try it again now.</div>
<div><br>
<div>
<div>
<div>On Apr 18, 2013, at 1:00 , Yaowen Tu wrote:</div>
<br class="Apple-interchange-newline">
<blockquote type="cite">
<div dir="ltr">
<div>
<div>
<div>
<div>
<div>Scott,<br>
<br>
Sorry about that I should have been more careful when I send out the first email.<br>
<br>
</div>
I am trying to use certificate viewer to view the X509Certificate, and it looks like they are different:<br>
<br>
</div>
This is the X509Certificate captured from idp metadata file:<br>
MIIDKzCCAhOgAwIBAgIUBmArgGbiur6uu2YfHg5RCcmZWkQwDQYJKoZIhvcNAQEF<br>
BQAwGzEZMBcGA1UEAxMQaWRwLnRlc3RzaGliLm9yZzAeFw0xMjAyMjQwMTEwMDla<br>
Fw0zMjAyMjQwMTEwMDlaMBsxGTAXBgNVBAMTEGlkcC50ZXN0c2hpYi5vcmcwggEi<br>
MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCUS4L8kz+wB94NmjiNh0Ff3KuB<br>
tM2L/oeBzpQJoTALQ5HLnZdCWHRaQYD2LV2lp1zPQTBpS1aRghGrHUrBCuowq172<br>
H9RcEk3vOb44NnVmxFCBTIbCDv6SjjLBY35QTwzcQVwWLIMq833Wt4dQKrapfwJr<br>
p8jJd8RobpFJl0K3BbwtFTa3gBL+FDT5jYpsmld3oOLDSgUG+lqcjjVPQMgY+FC2<br>
Jb/tyzMibd8AFUTck1TYZ8uSk44XtYfTMvz3fZYCNsympxGUVk5Qno2AoZvObSbF<br>
unC2MSEjKQzEmdwBUJkIhV81sjC+ofH4JuImY9y7I5BA62HET5/J8/SpKV0BAgMB<br>
AAGjZzBlMEQGA1UdEQQ9MDuCEGlkcC50ZXN0c2hpYi5vcmeGJ2h0dHBzOi8vaWRw<br>
LnRlc3RzaGliLm9yZy9pZHAvc2hpYmJvbGV0aDAdBgNVHQ4EFgQUtEusYC7zyykK<br>
OxNnq+L9Wo67uy8wDQYJKoZIhvcNAQEFBQADggEBABr3g1EG530HWcovEFo/3RC9<br>
AWnD0I7zEbFZEDdMPHRdmdjpzskMF6J+Olq86qBaKL5Wn92BNIPmJvFpypokRmlo<br>
kti7aJqvjggXNRG+6yLqBbZX4P1cK6tyT8SAZ5zwn52uw1+XFJS6HHUtPLcbnhXe<br>
2YnXpgEE6dkx1BhEL+vKSFOeLlFiGiex3DsA5j4qpR+Za2FTbAWl0eU8H4ipMNTp<br>
CdSxaerQTV4NMw5asLXDtRF5AMBwv2nXer+MOx2YN6t85+TCaXeQlx9svl2a5JTz<br>
1Hayl8yhcskcx9B2O2DTQsgL0lFWeogJ2O8qoHI0eST/mCDDbnfKZ7uGuGswyws=<br>
<br>
</div>
This is the certificate in the <Assertion> tag that return to my SP:<br>
MIIEDjCCAvagAwIBAgIBADANBgkqhkiG9w0BAQUFADBnMQswCQYDVQQGEwJVUzEVMBMGA1UECBMM<br>
UGVubnN5bHZhbmlhMRMwEQYDVQQHEwpQaXR0c2J1cmdoMREwDwYDVQQKEwhUZXN0U2hpYjEZMBcG<br>
A1UEAxMQaWRwLnRlc3RzaGliLm9yZzAeFw0wNjA4MzAyMTEyMjVaFw0xNjA4MjcyMTEyMjVaMGcx<br>
CzAJBgNVBAYTAlVTMRUwEwYDVQQIEwxQZW5uc3lsdmFuaWExEzARBgNVBAcTClBpdHRzYnVyZ2gx<br>
ETAPBgNVBAoTCFRlc3RTaGliMRkwFwYDVQQDExBpZHAudGVzdHNoaWIub3JnMIIBIjANBgkqhkiG<br>
9w0BAQEFAAOCAQ8AMIIBCgKCAQEArYkCGuTmJp9eAOSGHwRJo1SNatB5ZOKqDM9ysg7CyVTDClcp<br>
u93gSP10nH4gkCZOlnESNgttg0r+MqL8tfJC6ybddEFB3YBo8PZajKSe3OQ01Ow3yT4I+Wdg1tsT<br>
pSge9gEz7SrC07EkYmHuPtd71CHiUaCWDv+xVfUQX0aTNPFmDixzUjoYzbGDrtAyCqA8f9CN2txI<br>
fJnpHE6q6CmKcoLADS4UrNPlhHSzd614kR/JYiks0K4kbRqCQF0Dv0P5Di+rEfefC6glV8ysC8dB<br>
5/9nb0yh/ojRuJGmgMWHgWk6h0ihjihqiu4jACovUZ7vVOCgSE5Ipn7OIwqd93zp2wIDAQABo4HE<br>
MIHBMB0GA1UdDgQWBBSsBQ869nh83KqZr5jArr4/7b+QazCBkQYDVR0jBIGJMIGGgBSsBQ869nh8<br>
3KqZr5jArr4/7b+Qa6FrpGkwZzELMAkGA1UEBhMCVVMxFTATBgNVBAgTDFBlbm5zeWx2YW5pYTET<br>
MBEGA1UEBxMKUGl0dHNidXJnaDERMA8GA1UEChMIVGVzdFNoaWIxGTAXBgNVBAMTEGlkcC50ZXN0<br>
c2hpYi5vcmeCAQAwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQUFAAOCAQEAjR29PhrCbk8qLN5M<br>
FfSVk98t3CT9jHZoYxd8QMRLI4j7iYQxXiGJTT1FXs1nd4Rha9un+LqTfeMMYqISdDDI6tv8iNpk<br>
OAvZZUosVkUo93pv1T0RPz35hcHHYq2yee59HJOco2bFlcsH8JBXRSRrJ3Q7Eut+z9uo80JdGNJ4<br>
/SJy5UorZ8KazGj16lfJhOBXldgrhppQBb0Nq6HKHguqmwRfJ+WkxemZXzhediAjGeka8nz8Jjwx<br>
pUjAiSWYKLtJhGEaTqCYxCCX2Dw+dOTqUzHOZ7WKv4JXPK5G/Uhr8K/qhmFT2nIQi538n6rVYLeW<br>
<br>
</div>
Can you confirm if they are using the same key to generate the digest? I am not farmiliar with this part, if you can tell me how to do that I would be glad to do it by myself.<br>
<br>
</div>
Thanks<br>
Yaowen<br>
</div>
<div class="gmail_extra"><br clear="all">
<div>Yaowen</div>
<br>
<br>
<div class="gmail_quote">On Wed, Apr 17, 2013 at 5:42 PM, Nate Klingenstein <span dir="ltr">
<<a href="mailto:ndk@internet2.edu" target="_blank">ndk@internet2.edu</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Yaowen,<br>
<br>
I think it's using the keypair(and certificate) as configured in metadata to sign assertions:<br>
<br>
<ds:SignatureValue>gVi0RA0xHz3UKQIhv464B4i5hrdq88GbL5JgS5m6zUtox7zW3ttBX6gU2QDEb6oXCB/GJ1JAtqYzmjhXXP+TYyVVs+htVhty4aXABj3+0cE/cgKULzksgr42GMOmib7O6Zvy8Yp6mQu72fCSJdDvZsI3bRgq24HOY1Y6qR2rzC78ApVh7u+bnGOx9xil4pFokWGdJTf22xD1ZLYeNzVkO2dKLhK+SSruPR1sbkj6WCTDEiSW5aIxG/hPbx18LzEJBVyiiNq/ppr7OB4xe7GOa3+AJPHNdwxz6BPMXoaHbnG6ITQB1Gx2uKETeqPwW6aytC9DieddJ60zWQt7r/SSkA==</ds:SignatureValue><ds:KeyInfo><ds:X509Data><ds:X509Certificate>MIIEDjCCAvagAwIBAgIBADANBgkqhkiG9w0BAQUFADBnMQswCQYDVQQGEwJVUzEVMBMGA1UECBMM<br>
UGVubnN5bHZhbmlhMRMwEQYDVQQHEwpQaXR0c2J1cmdoMREwDwYDVQQKEwhUZXN0U2hpYjEZMBcG<br>
A1UEAxMQaWRwLnRlc3RzaGliLm9yZzAeFw0wNjA4MzAyMTEyMjVaFw0xNjA4MjcyMTEyMjVaMGcx<br>
CzAJBgNVBAYTAlVTMRUwEwYDVQQIEwxQZW5uc3lsdmFuaWExEzARBgNVBAcTClBpdHRzYnVyZ2gx<br>
ETAPBgNVBAoTCFRlc3RTaGliMRkwFwYDVQQDExBpZHAudGVzdHNoaWIub3JnMIIBIjANBgkqhkiG<br>
9w0BAQEFAAOCAQ8AMIIBCgKCAQEArYkCGuTmJp9eAOSGHwRJo1SNatB5ZOKqDM9ysg7CyVTDClcp<br>
u93gSP10nH4gkCZOlnESNgttg0r+MqL8tfJC6ybddEFB3YBo8PZajKSe3OQ01Ow3yT4I+Wdg1tsT<br>
pSge9gEz7SrC07EkYmHuPtd71CHiUaCWDv+xVfUQX0aTNPFmDixzUjoYzbGDrtAyCqA8f9CN2txI<br>
fJnpHE6q6CmKcoLADS4UrNPlhHSzd614kR/JYiks0K4kbRqCQF0Dv0P5Di+rEfefC6glV8ysC8dB<br>
5/9nb0yh/ojRuJGmgMWHgWk6h0ihjihqiu4jACovUZ7vVOCgSE5Ipn7OIwqd93zp2wIDAQABo4HE<br>
MIHBMB0GA1UdDgQWBBSsBQ869nh83KqZr5jArr4/7b+QazCBkQYDVR0jBIGJMIGGgBSsBQ869nh8<br>
3KqZr5jArr4/7b+Qa6FrpGkwZzELMAkGA1UEBhMCVVMxFTATBgNVBAgTDFBlbm5zeWx2YW5pYTET<br>
MBEGA1UEBxMKUGl0dHNidXJnaDERMA8GA1UEChMIVGVzdFNoaWIxGTAXBgNVBAMTEGlkcC50ZXN0<br>
c2hpYi5vcmeCAQAwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQUFAAOCAQEAjR29PhrCbk8qLN5M<br>
FfSVk98t3CT9jHZoYxd8QMRLI4j7iYQxXiGJTT1FXs1nd4Rha9un+LqTfeMMYqISdDDI6tv8iNpk<br>
OAvZZUosVkUo93pv1T0RPz35hcHHYq2yee59HJOco2bFlcsH8JBXRSRrJ3Q7Eut+z9uo80JdGNJ4<br>
/SJy5UorZ8KazGj16lfJhOBXldgrhppQBb0Nq6HKHguqmwRfJ+WkxemZXzhediAjGeka8nz8Jjwx<br>
pUjAiSWYKLtJhGEaTqCYxCCX2Dw+dOTqUzHOZ7WKv4JXPK5G/Uhr8K/qhmFT2nIQi538n6rVYLeW<br>
j8Bbnl+ev0peYzxFyF5sQA==</ds:X509Certificate></ds:X509Data></ds:KeyInfo></ds:Signature><saml2:Subject><saml2:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient" NameQualifier="<a href="https://idp.testshib.org/idp/shibboleth" target="_blank">https://idp.testshib.org/idp/shibboleth</a>"
SPNameQualifier="<a href="https://sp.testshib.org/shibboleth-sp" target="_blank">https://sp.testshib.org/shibboleth-sp</a>">_4639f7dc6610a693820b8bcbf9123f20</saml2:NameID><saml2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><br>
<br>
<br>
<br>
<ds:KeyInfo><br>
<ds:X509Data><br>
<ds:X509Certificate><br>
MIIEDjCCAvagAwIBAgIBADANBgkqhkiG9w0BAQUFADBnMQswCQYDVQQGEwJVUzEV<br>
MBMGA1UECBMMUGVubnN5bHZhbmlhMRMwEQYDVQQHEwpQaXR0c2J1cmdoMREwDwYD<br>
VQQKEwhUZXN0U2hpYjEZMBcGA1UEAxMQaWRwLnRlc3RzaGliLm9yZzAeFw0wNjA4<br>
MzAyMTEyMjVaFw0xNjA4MjcyMTEyMjVaMGcxCzAJBgNVBAYTAlVTMRUwEwYDVQQI<br>
EwxQZW5uc3lsdmFuaWExEzARBgNVBAcTClBpdHRzYnVyZ2gxETAPBgNVBAoTCFRl<br>
c3RTaGliMRkwFwYDVQQDExBpZHAudGVzdHNoaWIub3JnMIIBIjANBgkqhkiG9w0B<br>
AQEFAAOCAQ8AMIIBCgKCAQEArYkCGuTmJp9eAOSGHwRJo1SNatB5ZOKqDM9ysg7C<br>
yVTDClcpu93gSP10nH4gkCZOlnESNgttg0r+MqL8tfJC6ybddEFB3YBo8PZajKSe<br>
3OQ01Ow3yT4I+Wdg1tsTpSge9gEz7SrC07EkYmHuPtd71CHiUaCWDv+xVfUQX0aT<br>
NPFmDixzUjoYzbGDrtAyCqA8f9CN2txIfJnpHE6q6CmKcoLADS4UrNPlhHSzd614<br>
kR/JYiks0K4kbRqCQF0Dv0P5Di+rEfefC6glV8ysC8dB5/9nb0yh/ojRuJGmgMWH<br>
gWk6h0ihjihqiu4jACovUZ7vVOCgSE5Ipn7OIwqd93zp2wIDAQABo4HEMIHBMB0G<br>
A1UdDgQWBBSsBQ869nh83KqZr5jArr4/7b+QazCBkQYDVR0jBIGJMIGGgBSsBQ86<br>
9nh83KqZr5jArr4/7b+Qa6FrpGkwZzELMAkGA1UEBhMCVVMxFTATBgNVBAgTDFBl<br>
bm5zeWx2YW5pYTETMBEGA1UEBxMKUGl0dHNidXJnaDERMA8GA1UEChMIVGVzdFNo<br>
aWIxGTAXBgNVBAMTEGlkcC50ZXN0c2hpYi5vcmeCAQAwDAYDVR0TBAUwAwEB/zAN<br>
BgkqhkiG9w0BAQUFAAOCAQEAjR29PhrCbk8qLN5MFfSVk98t3CT9jHZoYxd8QMRL<br>
I4j7iYQxXiGJTT1FXs1nd4Rha9un+LqTfeMMYqISdDDI6tv8iNpkOAvZZUosVkUo<br>
93pv1T0RPz35hcHHYq2yee59HJOco2bFlcsH8JBXRSRrJ3Q7Eut+z9uo80JdGNJ4<br>
/SJy5UorZ8KazGj16lfJhOBXldgrhppQBb0Nq6HKHguqmwRfJ+WkxemZXzhediAj<br>
Geka8nz8JjwxpUjAiSWYKLtJhGEaTqCYxCCX2Dw+dOTqUzHOZ7WKv4JXPK5G/Uhr<br>
8K/qhmFT2nIQi538n6rVYLeWj8Bbnl+ev0peYzxFyF5sQA==<br>
</ds:X509Certificate><br>
</ds:X509Data><br>
</ds:KeyInfo><br>
<br>
You might be looking at the encryption key, which corresponds to the SP and also matches metadata.<br>
<br>
Thanks,<br>
Nate.<br>
<div class="HOEnZb">
<div class="h5"><br>
On Apr 18, 2013, at 0:15 , Yaowen Tu wrote:<br>
<br>
> Actually I meant that the Assertion is signed. It looks like <a href="http://testshib.org/" target="_blank">
testshib.org</a> is using a different certificate to sign the assertion.<br>
><br>
> Thanks,<br>
> Yaowen<br>
><br>
> Yaowen<br>
><br>
><br>
> On Wed, Apr 17, 2013 at 5:08 PM, Yaowen Tu <<a href="mailto:yaowen.tu@gmail.com">yaowen.tu@gmail.com</a>> wrote:<br>
> But the response returned to my SP is signed. In the Assertion object, the isSigned() flag is true.<br>
><br>
> Did I miss anything?<br>
><br>
> Thanks,<br>
> Yaowen<br>
><br>
> Yaowen<br>
><br>
><br>
> On Wed, Apr 17, 2013 at 4:48 PM, Cantor, Scott <<a href="mailto:cantor.2@osu.edu">cantor.2@osu.edu</a>> wrote:<br>
> On 4/17/13 7:35 PM, "Yaowen Tu" <<a href="mailto:yaowen.tu@gmail.com">yaowen.tu@gmail.com</a>> wrote:<br>
> ><br>
> >From the SAMLResponse of the <a href="http://testshib.org/" target="_blank">testshib.org</a> <<a href="http://testshib.org/" target="_blank">http://testshib.org</a>> IdP, it<br>
> >contains a different certificate in the <Response> tag.<br>
><br>
> I just looked at a response from it. Since it's not signing the response,<br>
> there is no certificate in it. So I would guess that given nothing would<br>
> have changed, that you are probably mistaken about the issue.<br>
><br>
> -- Scott<br>
><br>
><br>
> --<br>
> To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">
users-unsubscribe@shibboleth.net</a><br>
><br>
><br>
> --<br>
> To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">
users-unsubscribe@shibboleth.net</a><br>
<br>
<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">
users-unsubscribe@shibboleth.net</a><br>
</div>
</div>
</blockquote>
</div>
<br>
</div>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">
users-unsubscribe@shibboleth.net</a></blockquote>
</div>
<br>
</div>
</div>
</body>
</html>