how to build keystore for shibboleth?

[Leonard Kroll]

Yes, one get generated when I run install.sh to install shibboleth.
I was hoping I could avoid taking the install process apart to figure out what the shibboleth install is doing.


Leonard Kroll
UNIX / GIS Administrator
Univ. Massachusetts Boston
Leonard(dot)Kroll(at)umb.edu
Phone: 617-287-5048
fax:      617-287-5224


-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Chad La Joie
Sent: Friday, October 28, 2011 4:49 PM
To: Shib Users
Subject: Re: how to build keystore for shibboleth?

You'll need to use whatever tools are provided by whatever system
needs the JKS file.  Nothing in the IdP uses one.  Your container
might, which is why we generate one automatically, but that's all done
programmatically, not using any particular command line tool.

On Fri, Oct 28, 2011 at 16:14, Leonard Kroll <Leonard.Kroll at umb.edu> wrote:
> Hi,
>
> Just got a cert from our CA EduCause.
>
> I have never done this before, do don't assume I know anything J
>
>
>
> How do I correctly create the keystore from the cert?
>
> I have server.crt, server,key and server.csr file.
>
> I also have a CA intermediate file with a csr chain in it.
>
>
>
> I tried to build the idp.jks file, but when I try to use it I get ssl
> errors.
>
> What did I miss doing or do wrong?
>
>
>
> Oct 28, 2011 3:58:10 PM org.apache.coyote.http11.Http11Protocol init
>
> SEVERE: Error initializing endpoint
>
> java.io.IOException: jsse.invalid_ssl_conf
>
>         at
> org.apache.tomcat.util.net.jsse.JSSESocketFactory.checkConfig(JSSESocketFactory.java:755)
>
>         at
> org.apache.tomcat.util.net.jsse.JSSESocketFactory.init(JSSESocketFactory.java:460)
>
>         at
> org.apache.tomcat.util.net.jsse.JSSESocketFactory.createSocket(JSSESocketFactory.java:130)
>
>         at org.apache.tomcat.util.net.JIoEndpoint.init(JIoEndpoint.java:538)
>
>         at
> org.apache.coyote.http11.Http11Protocol.init(Http11Protocol.java:176)
>
>         at
> org.apache.catalina.connector.Connector.initialize(Connector.java:1007)
>
>         at
> org.apache.catalina.core.StandardService.initialize(StandardService.java:677)
>
>         at
> org.apache.catalina.core.StandardServer.initialize(StandardServer.java:795)
>
>         at org.apache.catalina.startup.Catalina.load(Catalina.java:540)
>
>         at org.apache.catalina.startup.Catalina.load(Catalina.java:560)
>
>         at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
>
>         at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)
>
>         at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
>
>         at java.lang.reflect.Method.invoke(Unknown Source)
>
>         at org.apache.catalina.startup.Bootstrap.load(Bootstrap.java:261)
>
>         at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:413)
>
> Caused by: javax.net.ssl.SSLException: No available certificate or key
> corresponds to the SSL cipher suites which are ena
>
> bled.
>
>         at
> com.sun.net.ssl.internal.ssl.SSLServerSocketImpl.checkEnabledSuites(Unknown
> Source)
>
>         at com.sun.net.ssl.internal.ssl.SSLServerSocketImpl.accept(Unknown
> Source)
>
>         at
> org.apache.tomcat.util.net.jsse.JSSESocketFactory.checkConfig(JSSESocketFactory.java:751)
>
>         ... 15 more
>
>
>
>
>
>
>
>
>
> Leonard Kroll
> UNIX / GIS Administrator
> Univ. Massachusetts Boston
> Leonard(dot)Kroll(at)umb.edu
> Phone: 617-287-5048
> fax:      617-287-5224
>
>
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>



-- 
Chad La Joie
www.itumi.biz
trusted identities, delivered
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net