got SSLHandshakeException

[Wang, Holly]

I got " Authentication Failed" on the login.jsp when I try to log into the shibboleth, it seems like I get connected to my LDAP server based on the log infor, then I end up with following error  in /opt/shibboleth-idp/logs/idp-process.log, I can't retrieve all the metadata source, here is one of them:

11:26:38.121 - ERROR [org.opensaml.saml2.metadata.provider.HTTPMetadataProvider:273] - Error retrieving metadata from https://saqa.csun.edu/Shibboleth.sso/Metadata
javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path validation failed: java.security.cert.CertPathValidatorException: Path does not chain with any of the trust anchors


Yes, I use 443 as the https port. 


Holly Wang, IT Department  CSUN, 818-677-2031


-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Thursday, April 26, 2012 1:44 PM
To: Shib Users
Subject: Re: got SSLHandshakeException

On 4/26/12 4:13 PM, "Wang, Holly" <holly.wang at csun.edu> wrote:

>To set up the https, I used my own SSL certificate. Didn't use the 
>default one from the shibboleth while I run install.sh

Yes, but for which port? For 443, that's fine/expected. For 8443, that's a very bad idea.

>I am not sure if it has anything to do with the error I got:
>
>
>javax.net.ssl.SSLHandshakeException:
>sun.security.validator.ValidatorException: PKIX path validation failed:
>java.security.cert.CertPathValidatorException: Path does not chain with 
>any of the trust anchors

You're still not telling me where the error is though. If this is a Shibboleth issue, then it should be in a log from the IdP based on trying to do some specific thing. If it's not a Shibboleth issue, then I suggest you look into your container's documentation/support.

-- Scott

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net