Shibboleth: found encrypted assertions, but no CredentialResolver was available

I've gotten a Shibboleth Server Provider (SP) up and running, and I'm using the TestShib Identity Provider (IdP) for testing.

The configuration appears to be all correct, and when I requested my secured directory I was sent to the IdP where I logged in and then was sent back to https://example.org/Shibboleth.sso/SAML2/POST where I am getting a generic error message.

Checking the logs, I am told:

found encrypted assertions, but no CredentialResolver was available

I have rechecked the configuration, and there I have:

<CredentialResolver type="File" key="/etc/shibboleth/sp-key.pem" certificate="/etc/shibboleth/sp-cert.pem"/>

Both of these files are present at those locations.

I've restarted apache and retried, but still get the same error.

I don't know if it makes a difference - but only a subdirectory of the site has been secured - the documentroot is publicly available.