Hello John,

This appears when Sign AuthnRequest checkbox on your identity provider record is true and Signing/Encryption Key Alias and Password fields are empty or incorrect. The default OOB value for Signing/Encryption Key Alias and Signing/Encryption Key Password is saml2sp.

For quick testing purpose, uncheck the Sign AuthnRequest checkbox, save the identity provider record and try generating metadata again, it should help. When it helps then please make sure you have the correct value for Signing/Encryption Key Alias and Password fields when Sign AuthnRequest checkbox is enabled.

Thanks, Lalit