Saml2: Service Certificate- Provided certificate is not valid because it does not contain a private key.

[alenjose007]

Hi
I have configured with signing certificate and service certificate. We are getting only the public key from the server side team. From this we created service certificate. But it shows an error like -'Provided certificate is not valid because it does not contain a private key.'

Is there any way to validate signature with publickey only.

Thanks in advance.

Regards
Alen Jose

[AndersAbel]

You only need the public key from the server (Identity Provider). It should be added to the SigningKeys collection of the IdentityProvider object. The Idp signing keys only requires the public key.

[saurabh12231978]

Hi Anders, I am getting the same error("Provided certificate is not valid because it does not contain a private key.") for my SP.

In kentor mvc sample I loaded the SP metadata as below:

<kentor.authServices entityId="http://localhost:2181/AuthServices" returnUrl="http://localhost:2181/" discoveryServiceUrl="https://saml.myIDP.com/DiscoveryService">
    <identityProviders>
      <add entityId="https://saml.myIDP.com/Metadata" signOnUrl="https://saml.myIDP.com/" logoutUrl="https://thirdpartyServiceProvider.com/saml/logout" allowUnsolicitedAuthnResponse="true" binding="HttpPost">
        <signingCertificate fileName="~/App_Data/Kentor.AuthServices.StubIdp.cer" /> 
      </add>
    </identityProviders>
    <federations>
      <add metadataLocation="https://thirdpartyServiceProvider.com/saml/metadata" allowUnsolicitedAuthnResponse="true" />
    </federations>
    <serviceCertificates>
      <add fileName="~/App_Data/serviceProviderCert.cer" />
    </serviceCertificates>
  </kentor.authServices>

And the serviceProviderCert.cer is the file I have created by extracting the X509 value from SP metadata and putting in to .cer with -----BEGIN xxxxxx END-----

Please let me know how kentor can get private key ? Do I need to ask my SP to send cert(pfx file) ? Not able to figure out why so complex to implement SLO as I already sent you ques .