<div dir="ltr"><div>I'm certain it doesn't have just PKIX given that every Shibboleth SP is self-signed out of the box, but I did check.<br><br>    <security:TrustEngine id="shibboleth.SignatureTrustEngine" xsi:type="security:SignatureChaining"><br>        <security:TrustEngine id="shibboleth.SignatureMetadataExplicitKeyTrustEngine" xsi:type="security:MetadataExplicitKeySignature" metadataProviderRef="ShibbolethMetadata"/>                            <br>        <security:TrustEngine id="shibboleth.SignatureMetadataPKIXTrustEngine" xsi:type="security:MetadataPKIXSignature" metadataProviderRef="ShibbolethMetadata"/><br>    </security:TrustEngine><br><br>    <security:SecurityPolicy id="shibboleth.SAML2SSOSecurityPolicy" xsi:type="security:SecurityPolicyType"><br>        <security:Rule xsi:type="samlsec:Replay"/><br>        <security:Rule xsi:type="samlsec:IssueInstant"/><br>        <security:Rule xsi:type="samlsec:SAML2AuthnRequestsSigned"/><br>        <security:Rule xsi:type="samlsec:ProtocolWithXMLSignature" trustEngineRef="shibboleth.SignatureTrustEngine"/><br>        <security:Rule xsi:type="samlsec:SAML2HTTPRedirectSimpleSign" trustEngineRef="shibboleth.SignatureTrustEngine"/><br>        <security:Rule xsi:type="samlsec:SAML2HTTPPostSimpleSign" trustEngineRef="shibboleth.SignatureTrustEngine"/><br>        <security:Rule xsi:type="samlsec:MandatoryIssuer"/><br>    </security:SecurityPolicy><br><br></div>I'm ready to increase the log level for you.  Please ping off list when you're ready.<br></div>