<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none"><!--P{margin-top:0;margin-bottom:0;} --></style>
</head>
<body dir="ltr" style="font-size:12pt;color:#000000;background-color:#FFFFFF;font-family:Calibri,Arial,Helvetica,sans-serif;">
<p>Thank you for the info and sorry for the Typo around the cert </p>
<p><br>
</p>
<p>After you removed the EC cert from the metadata, is the request then processed successfully?
</p>
<p><br>
</p>
<p>- Yes the site is working correctly once the cert has been removed, as you noticed they are signing with one of the other 2 certs... </p>
<p><br>
</p>
<p><br>
</p>
<div style="color: rgb(33, 33, 33);">
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="divRplyFwdMsg" dir="ltr"><font style="font-size:11pt" color="#000000" face="Calibri, sans-serif"><b>From:</b> users <users-bounces@shibboleth.net> on behalf of Brent Putman <putmanb@georgetown.edu><br>
<b>Sent:</b> 25 July 2017 19:48<br>
<b>To:</b> users@shibboleth.net<br>
<b>Subject:</b> [FORGED] Re: Certificate Load Issue within Java / Shibboleth 3.2.1</font>
<div> </div>
</div>
<div>
<p><br>
</p>
<br>
<div class="moz-cite-prefix">On 7/25/17 3:32 AM, Brent Putman wrote:<br>
</div>
<blockquote type="cite"><br>
<br>
<blockquote type="cite">
<pre>2017-07-25 13:53:16,725 - WARN [org.opensaml.saml.common.binding.security.impl.BaseSAMLSimpleSignatureSecurityHandler:291] - Message Handler: Error evaluating the request's simple signature using the trust engine
org.opensaml.security.SecurityException: Error resolving trusted credentials
at org.opensaml.xmlsec.signature.support.impl.ExplicitKeySignatureTrustEngine.doValidate(ExplicitKeySignatureTrustEngine.java:147)
Caused by: net.shibboleth.utilities.java.support.resolver.ResolverException: Error processing KeyInfo child element
at org.opensaml.xmlsec.keyinfo.impl.BasicProviderKeyInfoCredentialResolver.processKeyInfoChild(BasicProviderKeyInfoCredentialResolver.java:322)
Caused by: org.opensaml.security.SecurityException: Error extracting certificates from X509Data
at org.opensaml.xmlsec.keyinfo.impl.provider.InlineX509DataProvider.extractCertificates(InlineX509DataProvider.java:192)
</pre>
</blockquote>
<br>
<br>
Is this from a signed SAML request? That's what it looks like to me... except it can't be Redirect b/c that doesn't convey a KeyInfo. So it would have to be POST SimpleSign, which is also unusual. Although I guess since it appears to be a Shibboleth SP,
then it's supported, and maybe there's some way this has been (mis)configured. <br>
</blockquote>
<br>
Oh, never mind. I misread the trace. I think the actual cert error is coming from the metadata credential resolver used by the trust engine, processing the entity's metadata's KeyDescriptor/KeyInfo. So it probably is just a plain old signed Redirect binding
request.<br>
<br>
After you removed the EC cert from the metadata, is the request then processed successfully? If so, then they're signing with one of the other 2 certs (RSA), and that's probably an acceptable workaround, if you are willing to live with having to modify the
metadata on your side like that. You still might want to politely suggest that they re-consider that EC cert and re-generate it with a named curve.<br>
<br>
If not (or if they *do* start signing to you with that EC cert in the future), then you have to do one of my other suggestions.<br>
<br>
--Brent<br>
</div>
</div>
</body>
</html>