Some problems about the certificate

[Peter Schober]

* 杨如鹏 <orbbyrp at gmail.com> [2012-04-24 11:16]:
> Hello, everyone. I am really new to shibboleth, and now I am trying to
> configure a simple test system for  shibboleth idp and sp. But there are
> some problems when the sp tries to get attribute from the idp. The related
> logs are here. The key in metadata to sp is the same as the content of
> idp.crt in idp. I do not how it comes.
[...]
> 2012-04-24 16:35:38 ERROR XMLTooling.SOAPTransport.CURL [2]: supplied
> TrustEngine failed to validate SSL/TLS server certificate
> 2012-04-24 16:35:38 ERROR Shibboleth.AttributeResolver.Query [2]: exception
> during SAML query to
> https://example.com:8443/idp/profile/SAML2/SOAP/AttributeQuery:
> CURLSOAPTransport failed while contacting SOAP endpoint (
> https://example.com:8443/idp/profile/SAML2/SOAP/AttributeQuery): SSL
> certificate problem, verify that the CA cert is OK. Details:
> error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify
> failed

Well, then whatever the IdP serves up on port 8443 is not that same
public key. How is the IdP deployed? Tomcat solo? Tomcat (or some
other Java servelt container) behind httpd? Did you follow the
Shibboleth documentation for setting up the IdP with the extra port
8443?

The other question is why your SP would need to perform an attribute
query in the first place, when the IdP could have pushed any
attributes over the browser.
-peter