[JIRA] (OSJ-379) "trustAnchors parameter must be non-empty" failure in httpClient

[Brent Putman (Jira)]

Brent Putman ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A97de0981-adc3-4044-95ed-131622fad81e ) *commented* on OSJ-379 ( https://shibboleth.atlassian.net/browse/OSJ-379?atlOrigin=eyJpIjoiNTFiYWZiOGIxYzdjNDdlZmJmY2QxM2EyYzU1M2Y1OTMiLCJwIjoiaiJ9 )

Re: "trustAnchors parameter must be non-empty" failure in httpClient ( https://shibboleth.atlassian.net/browse/OSJ-379?atlOrigin=eyJpIjoiNTFiYWZiOGIxYzdjNDdlZmJmY2QxM2EyYzU1M2Y1OTMiLCJwIjoiaiJ9 )

Ah! I looked at our shibboleth.net ( http://shibboleth.net ) which is also Rocky 8.7, and I learned new stuff. All the files under /etc/pki/ca-trust/extracted/ are dynamically generated from source files. See the README there and also in the subdir at java/README.

So based on that, if the update-ca-trust command is being run (from cron or manually, etc) with your live IdP up and processing requests, then that would be highly suspicious.

Would be interesting to say compare the last modified timestamp of that file over time with the IdP errors, and see if any match up.

( https://shibboleth.atlassian.net/browse/OSJ-379#add-comment?atlOrigin=eyJpIjoiNTFiYWZiOGIxYzdjNDdlZmJmY2QxM2EyYzU1M2Y1OTMiLCJwIjoiaiJ9 ) Add Comment ( https://shibboleth.atlassian.net/browse/OSJ-379#add-comment?atlOrigin=eyJpIjoiNTFiYWZiOGIxYzdjNDdlZmJmY2QxM2EyYzU1M2Y1OTMiLCJwIjoiaiJ9 )

Get Jira notifications on your phone! Download the Jira Cloud app for Android ( https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail ) or iOS ( https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8 ) This message was sent by Atlassian Jira (v1001.0.0-SNAPSHOT#100225- sha1:d57183e )
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/commits/attachments/20230518/c08b56f4/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-comment-icon-fe02e628-f3eb-477c-9282-d0739260a5d2
Type: image/png
Size: 1084 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20230518/c08b56f4/attachment-0003.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-avatar-c95c9f29-a303-46aa-9716-1408cb8a9fa5
Type: image/png
Size: 345 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20230518/c08b56f4/attachment-0004.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-footer-desktop-logo-1af6ce3d-e8f4-4941-9b3e-fc9c670c6cbd
Type: image/png
Size: 10805 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20230518/c08b56f4/attachment-0005.png>