<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">Hello,<div class=""><br class=""></div><div class="">I’ve been testing my upgrade of IdPv3 and noticed the following two debug messages on testshib occur</div><div class=""><br class=""></div><div class=""><pre style="font-variant-ligatures: normal; font-variant-position: normal; font-variant-numeric: normal; font-variant-alternates: normal; font-variant-east-asian: normal; line-height: normal; widows: 1; word-wrap: break-word; white-space: pre-wrap;" class=""><pre style="font-variant-ligatures: normal; font-variant-position: normal; font-variant-numeric: normal; font-variant-alternates: normal; font-variant-east-asian: normal; line-height: normal; word-wrap: break-word; white-space: pre-wrap;" class="">DEBUG XMLTooling.CredentialCriteria [1637]: key algorithm didn't match ('AES' != 'RSA')
DEBUG XMLTooling.KeyInfoResolver.Inline [1637]: resolving ds:X509Certificate
DEBUG XMLTooling.KeyInfoResolver.Inline [1637]: resolved 1 certificate(s)
DEBUG XMLTooling.CredentialCriteria [1637]: credential name(s) didn't overlap
DEBUG XMLTooling.CredentialCriteria [1637]: keys didn't match</pre><div class="">and</div><div class=""><pre style="font-variant-ligatures: normal; font-variant-position: normal; font-variant-numeric: normal; font-variant-alternates: normal; font-variant-east-asian: normal; line-height: normal; word-wrap: break-word; white-space: pre-wrap;" class="">DEBUG XMLTooling.KeyInfoResolver.Inline [1634]: resolving ds:X509Certificate
DEBUG XMLTooling.KeyInfoResolver.Inline [1634]: resolved 1 certificate(s)
DEBUG XMLTooling.KeyInfoResolver.Inline [1634]: resolved 0 CRL(s)
DEBUG XMLTooling.TrustEngine.ExplicitKey [1634]: attempting to match credentials from peer with end-entity certificate
DEBUG XMLTooling.TrustEngine.ExplicitKey [1634]: no keys within this peer's key information matched the given end-entity certificate
DEBUG XMLTooling.TrustEngine.PKIX [1634]: performing certificate path validation...
DEBUG XMLTooling.TrustEngine.PKIX [1634]: failed to validate certificate chain using supplied PKIX information
ERROR XMLTooling.SOAPTransport.CURL [1634]: supplied TrustEngine failed to validate SSL/TLS server certificate
</pre></div><div class="">any comments/suggestions on these would be great.</div><div class=""><br class=""></div><div class=""><br class=""></div><div class=""><br class=""></div><div class="">I’m also dealing with a outside sp (not using shib, but the issue may be on my side although I have some doubts) that is insisting I’m sending signed assertions which I believe I’m not (default is false, and I’ve humored them and manually added it to no avail). I’m not sure how to move forward with them, they’re going off of the following</div><div class=""><pre style="box-sizing: border-box; margin-top: 0px; margin-bottom: 10px; padding: 9.5px; font-size: 13px; font-family: Menlo, Monaco, Consolas, 'Courier New', monospace; border: 0px; line-height: 1.42857; word-break: normal; word-wrap: normal; color: rgb(87, 90, 103); border-top-left-radius: 4px; border-top-right-radius: 4px; border-bottom-right-radius: 4px; border-bottom-left-radius: 4px; max-height: 500px; overflow: auto; font-variant-ligatures: normal; font-variant-position: normal; font-variant-numeric: normal; font-variant-alternates: normal; font-variant-east-asian: normal; background-color: rgb(245, 245, 245);" class=""><code style="box-sizing: border-box; font-size: inherit; font-family: Menlo, Monaco, Consolas, 'Courier New', monospace; border: 0px; padding: 0px; color: inherit; border-top-left-radius: 0px; border-top-right-radius: 0px; border-bottom-right-radius: 0px; border-bottom-left-radius: 0px; word-break: normal; word-wrap: normal; background-color: transparent;" class="">ERROR saml.Consumer: Error processing IdP response
org.opensaml.common.SAMLException: org.opensaml.xml.validation.ValidationException: Signature cannot be validated</code></pre><div class="">so if anyone has any suggestions on what I could try on my end that’d be great. Otherwise I understand it’s not shibboleth so just ignore this last bit.</div></div><div class=""><br class=""></div><div class="">Thanks,</div><div class="">Mike</div></pre></div></body></html>