title: Simple signature validation (with no request-derived credentials) failed
body: <p>I have an existing spring webapp which uses SAML to let users login via a third party site. Users login on the third party site and use SAML to single-sign-on into my application. The third party site recently had their certificate expire and they sent me a new .crt file to import into my java keystore. I used the following commands to update my java keystore:</p>
  
  <pre><code>keytool -delete -alias thirdPartyCertificate -keystore myKeystore.jks
  keytool -import -trustcacerts -alias thirdPartyCertificate -file 2017-third-party-certificate.crt -keystore myKeystore.jks
  </code></pre>
  
  <p>Both commands completed successfully (and I can run a -list on the keystore and see that the new certificate is present and not expired). However, after I restarted my java webserver, the single sign on did not work. It threw the following two warnings and then failed to login the user:</p>
  
  <pre><code>WARN  org.opensaml.common.binding.security.BaseSAMLSimpleSignatureSecurityPolicyRule - Simple signature validation (with no request-derived credentials) failed
  WARN  org.opensaml.common.binding.security.BaseSAMLSimpleSignatureSecurityPolicyRule - Validation of request simple signature failed for context issuer: &lt;certificate_url_omitted&gt;
  </code></pre>
  
  <p>What would cause the certificate validation to fail? I don't think that their certificate is bad because several other webapp maintainers were able to successfully use the new certificate. Is there some step that I missed in installing the new certificate?</p>