In the environment where you are getting the error, set the relevant SAML log nodes to TRACE level and trigger the SP metadata download again. This will produce the full stacktrace in the runtime logs, which usually reveals the exact root cause (for example, missing configuration, keystore/certificate access, base URL generation, proxy headers, or permission issues).
So the recommendation is: enable TRACE logging → reproduce the issue → check the first “Caused by something” section in the logs to identify the root cause.