got SSLHandshakeException

[Cantor, Scott]

On 4/26/12 4:51 PM, "Wang, Holly" <holly.wang at csun.edu> wrote:

>I got " Authentication Failed" on the login.jsp when I try to log into
>the shibboleth, it seems like I get connected to my LDAP server based on
>the log infor, then I end up with following error  in
>/opt/shibboleth-idp/logs/idp-process.log, I can't retrieve all the
>metadata source, here is one of them:
>
>11:26:38.121 - ERROR
>[org.opensaml.saml2.metadata.provider.HTTPMetadataProvider:273] - Error
>retrieving metadata from https://saqa.csun.edu/Shibboleth.sso/Metadata
>javax.net.ssl.SSLHandshakeException:
>sun.security.validator.ValidatorException: PKIX path validation failed:
>java.security.cert.CertPathValidatorException: Path does not chain with
>any of the trust anchors

Well, you have two issues here:

a) You should never be pulling metadata directly from an SP like that,
because it's meaningless for trust, and prone to break, since that handler
is NOT meant to provide production metadata. For testing, it's ok.

b) The error has nothing to do with your certificate. The IdP metadata
provider does not ignore the transport layer and if you're going to pull
metadata over https, then the Java runtime has to trust the cert. There's
plenty in the archives on that sort of thing, same thing applies to doing
LDAP connections over TLS.

-- Scott