how to build keystore for shibboleth?

[Chad La Joie]

Well, the first question is, does your setup even require a JKS?  Does
the container support something else (e.g. Tomcat supports PKCS12
which can be generated with openssl)?  Does the container provide
tools for generating the JKS?

On Fri, Oct 28, 2011 at 16:52, Leonard Kroll <Leonard.Kroll at umb.edu> wrote:
> Yes, one get generated when I run install.sh to install shibboleth.
> I was hoping I could avoid taking the install process apart to figure out what the shibboleth install is doing.
>
>
> Leonard Kroll
> UNIX / GIS Administrator
> Univ. Massachusetts Boston
> Leonard(dot)Kroll(at)umb.edu
> Phone: 617-287-5048
> fax:      617-287-5224
>
>
> -----Original Message-----
> From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Chad La Joie
> Sent: Friday, October 28, 2011 4:49 PM
> To: Shib Users
> Subject: Re: how to build keystore for shibboleth?
>
> You'll need to use whatever tools are provided by whatever system
> needs the JKS file.  Nothing in the IdP uses one.  Your container
> might, which is why we generate one automatically, but that's all done
> programmatically, not using any particular command line tool.
>
> On Fri, Oct 28, 2011 at 16:14, Leonard Kroll <Leonard.Kroll at umb.edu> wrote:
>> Hi,
>>
>> Just got a cert from our CA EduCause.
>>
>> I have never done this before, do don't assume I know anything J
>>
>>
>>
>> How do I correctly create the keystore from the cert?
>>
>> I have server.crt, server,key and server.csr file.
>>
>> I also have a CA intermediate file with a csr chain in it.
>>
>>
>>
>> I tried to build the idp.jks file, but when I try to use it I get ssl
>> errors.
>>
>> What did I miss doing or do wrong?
>>
>>
>>
>> Oct 28, 2011 3:58:10 PM org.apache.coyote.http11.Http11Protocol init
>>
>> SEVERE: Error initializing endpoint
>>
>> java.io.IOException: jsse.invalid_ssl_conf
>>
>>         at
>> org.apache.tomcat.util.net.jsse.JSSESocketFactory.checkConfig(JSSESocketFactory.java:755)
>>
>>         at
>> org.apache.tomcat.util.net.jsse.JSSESocketFactory.init(JSSESocketFactory.java:460)
>>
>>         at
>> org.apache.tomcat.util.net.jsse.JSSESocketFactory.createSocket(JSSESocketFactory.java:130)
>>
>>         at org.apache.tomcat.util.net.JIoEndpoint.init(JIoEndpoint.java:538)
>>
>>         at
>> org.apache.coyote.http11.Http11Protocol.init(Http11Protocol.java:176)
>>
>>         at
>> org.apache.catalina.connector.Connector.initialize(Connector.java:1007)
>>
>>         at
>> org.apache.catalina.core.StandardService.initialize(StandardService.java:677)
>>
>>         at
>> org.apache.catalina.core.StandardServer.initialize(StandardServer.java:795)
>>
>>         at org.apache.catalina.startup.Catalina.load(Catalina.java:540)
>>
>>         at org.apache.catalina.startup.Catalina.load(Catalina.java:560)
>>
>>         at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
>>
>>         at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)
>>
>>         at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
>>
>>         at java.lang.reflect.Method.invoke(Unknown Source)
>>
>>         at org.apache.catalina.startup.Bootstrap.load(Bootstrap.java:261)
>>
>>         at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:413)
>>
>> Caused by: javax.net.ssl.SSLException: No available certificate or key
>> corresponds to the SSL cipher suites which are ena
>>
>> bled.
>>
>>         at
>> com.sun.net.ssl.internal.ssl.SSLServerSocketImpl.checkEnabledSuites(Unknown
>> Source)
>>
>>         at com.sun.net.ssl.internal.ssl.SSLServerSocketImpl.accept(Unknown
>> Source)
>>
>>         at
>> org.apache.tomcat.util.net.jsse.JSSESocketFactory.checkConfig(JSSESocketFactory.java:751)
>>
>>         ... 15 more
>>
>>
>>
>>
>>
>>
>>
>>
>>
>> Leonard Kroll
>> UNIX / GIS Administrator
>> Univ. Massachusetts Boston
>> Leonard(dot)Kroll(at)umb.edu
>> Phone: 617-287-5048
>> fax:      617-287-5224
>>
>>
>>
>> --
>> To unsubscribe from this list send an email to
>> users-unsubscribe at shibboleth.net
>>
>
>
>
> --
> Chad La Joie
> www.itumi.biz
> trusted identities, delivered
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
>



-- 
Chad La Joie
www.itumi.biz
trusted identities, delivered