<div dir="ltr"><div>I know what's happening but I don't know why. I'm new to stuff like signing and encryption and the shibboleth docs don't explicitly say WHICH certificate you're supposed to point to with the certificateFile attribute of the SignatureValidation filter. Here is my Metadata provider configuration:<br><br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><MetadataProvider id="HTTPMetadataCRC"<br>                  xsi:type="DynamicHTTPMetadataProvider"><br>        <br>        <MetadataFilter xsi:type="SignatureValidation" requireSignedRoot="true"<br>                certificateFile="%{idp.home}/credentials/cert.pem"/><br></MetadataProvider> </blockquote><div><br></div><div>The cert.pem file is the SP's public key. The SAML request sent from the SP contains that same public key along with a DigestValue. But in the logs I have the following:</div></div><div><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">WARN [org.apache.xml.security.signature.Reference:791] - Verification failed for URI "#_someLongString"<br>WARN [org.apache.xml.security.signature.Reference:792] - Expected Digest: ABC123=<br>WARN [org.apache.xml.security.signature.Reference:793] - Actual Digest: XYZ456=<br>ERROR [org.opensaml.saml.metadata.resolver.filter.impl.SignatureValidationFilter:420] - Signature trust establishment failed for metadata entry <a href="https://mySP.net/rest/v2/sso/shibboleth/metadata">https://mySP.net/rest/v2/sso/shibboleth/metadata</a></blockquote><div><br></div><div>So, what specific cert file is the certificateFile attribute supposed to be pointing to? If it's supposed to be the SP's public key, why would the DigestValues be different?  </div></div>