<div dir="ltr">I've had Shibboleth SP (2.5.2) installed, configured, and working well for some time now. However, the partner I am integrating with (a commercial company, uses Ping Federate) is requiring me to make the following change: use their Verisign issued certificate for verifying message signatures. They were previously using a self-signed certificate, and everything was working well.<div>
<br></div><div>After reading the SP documentation, I concluded that I need to configure a new trust engine, so added this to the configuration under the ApplicationOverride element for this partner:</div><div><br></div><div>
<TrustEngine type="StaticPKIX" certificate="/etc/shibboleth/sso.crt" /></div><div><br></div><div>where sso.crt is the Verisign issued certificate. When I restart the shibd daemon, I see that it is picking up the cert in the logs:</div>
<div><br></div><div><div>2014-02-21 18:07:24 INFO Shibboleth.Application : building TrustEngine of type StaticPKIX...</div><div>2014-02-21 18:07:24 INFO XMLTooling.SecurityHelper : loading certificate(s) from file (/etc/shibboleth/sso.crt)</div>
<div>2014-02-21 18:07:24 INFO XMLTooling.CredentialResolver.File : no private key resolved, usable for verification/trust only.</div><div><br></div><div>However, when the partner attempts to login, they get an error and I see this in the log:</div>
<div><br></div><div><div>2014-02-21 18:28:30 DEBUG OpenSAML.MessageDecoder.SAML2 [4]: searching metadata for message issuer...</div><div>2014-02-21 18:28:30 ERROR OpenSSL [4]: path validation failure at depth(0): unable to get local issuer certificate</div>
<div>2014-02-21 18:28:30 ERROR OpenSAML.SecurityPolicyRule.XMLSigning [4]: unable to verify message signature with supplied trust engine</div></div><div><br></div><div>My assumption is that the SP somehow needs to access a root CA certificate. Is this assumption correct? If so how would I do that?</div>
<div><br></div><div>Thanks,</div><div><br></div>Dan
</div></div>