Help with error:14094416:SSL routines:SSL3_READ_BYTES:sslv3 alert certificate unknown

[Coeus[TM]]

Hi,

I am having a problem with the SP (we provide service to different
federations/Idps)
encountering the exception as posted below (the lines posted are
specific for an Idp
only):


2012-02-13 05:36:30 DEBUG XMLTooling.SOAPTransport.CURL [2]: sending
SOAP message to
https://idp.sample.net:8443/idp/profile/SAML1/SOAP/AttributeQuery
2012-02-13 05:36:30 DEBUG XMLTooling.libcurl [2]: About to connect()
to idp.sample.net port 8443

2012-02-13 05:36:30 DEBUG XMLTooling.libcurl [2]:   Trying 117.777.777.77...
2012-02-13 05:36:30 DEBUG XMLTooling.libcurl [2]: connected

2012-02-13 05:36:30 DEBUG XMLTooling.libcurl [2]: Connected to
idp.sample.net (117.777.777.77) port 8443

2012-02-13 05:36:30 DEBUG XMLTooling.libcurl [2]: successfully set
certificate verify locations:

2012-02-13 05:36:30 DEBUG XMLTooling.libcurl [2]:   CAfile:
/etc/pki/tls/certs/ca-bundle.crt
  CApath: none

2012-02-13 05:36:30 DEBUG XMLTooling.libcurl [2]: SSLv3, TLS
handshake, Client hello (1):

2012-02-13 05:36:30 DEBUG XMLTooling.libcurl [2]: SSLv3, TLS
handshake, Server hello (2):

2012-02-13 05:36:30 DEBUG XMLTooling.libcurl [2]: SSLv3, TLS
handshake, CERT (11):

2012-02-13 05:36:30 DEBUG XMLTooling.libcurl [2]: 
2012-02-13 05:36:30 DEBUG XMLTooling.SOAPTransport.CURL [2]: invoking
custom X.509 verify callback
2012-02-13 05:36:30 DEBUG XMLTooling.TrustEngine.ExplicitKey [2]:
attempting to match credentials from peer with end-entity certificate
2012-02-13 05:36:30 DEBUG XMLTooling.TrustEngine.ExplicitKey [2]:
end-entity certificate matches peer RSA key information
2012-02-13 05:36:30 DEBUG XMLTooling.libcurl [2]: SSLv3, TLS
handshake, Server key exchange (12):

2012-02-13 05:36:30 DEBUG XMLTooling.libcurl [2]: 
2012-02-13 05:36:30 DEBUG XMLTooling.libcurl [2]: SSLv3, TLS
handshake, Request CERT (13):

2012-02-13 05:36:30 DEBUG XMLTooling.libcurl [2]:
2012-02-13 05:36:30 DEBUG XMLTooling.libcurl [2]: SSLv3, TLS
handshake, Server finished (14):

2012-02-13 05:36:30 DEBUG XMLTooling.libcurl [2]: SSLv3, TLS
handshake, CERT (11):

2012-02-13 05:36:30 DEBUG XMLTooling.libcurl [2]: 
2012-02-13 05:36:30 DEBUG XMLTooling.libcurl [2]: SSLv3, TLS
handshake, Client key exchange (16):

2012-02-13 05:36:30 DEBUG XMLTooling.libcurl [2]: SSLv3, TLS
handshake, CERT verify (15):

2012-02-13 05:36:30 DEBUG XMLTooling.libcurl [2]: SSLv3, TLS change
cipher, Client hello (1):

2012-02-13 05:36:30 DEBUG XMLTooling.libcurl [2]: SSLv3, TLS
handshake, Finished (20):

2012-02-13 05:36:31 DEBUG XMLTooling.libcurl [2]: SSLv3, TLS alert,
Server hello (2):

2012-02-13 05:36:31 DEBUG XMLTooling.libcurl [2]: error:14094416:SSL
routines:SSL3_READ_BYTES:sslv3 alert certificate unknown

2012-02-13 05:36:31 DEBUG XMLTooling.libcurl [2]: Closing connection #0

2012-02-13 05:36:31 ERROR Shibboleth.AttributeResolver.Query [2]:
exception during SAML query to
https://idp.sample.net:8443/idp/profile/SAML1/SOAP/AttributeQuery:
CURLSOAPTransport failed while contacting SOAP responder:
error:14094416:SSL routines:SSL3_READ_BYTES:sslv3 alert certificate
unknown
2012-02-13 05:36:31 ERROR Shibboleth.AttributeResolver.Query [2]:
unable to obtain a SAML response from attribute authority


I have already read through the mailing list regarding the
"error:14094416..." Based from the discussions,
it all boils down to where Idp rejects SP's certificate (mod_ssl issues, etc..).

But one thing that is different in my case is that the Idp people told
me that they have already set SSLInsecureRenegotiation
and SSLVerifyClient to "optional_no_ca". They also included our
metadata. I am also sure
that I have the right key pairs and included their metadata in
wayfconfig.xml and shibboleth2.xml. I have another
federation/Idps to test to so I know that I still have the correct SP
configurations. Unfortunately, with all these applied,
I am still encountering the exception and I believe this is the reason
why a user (after logging in to the Idp auth site)
cannot successfully log in to the next SP page (the user is properly
directed to the page but prompts that the user
is not yet authorized to use the service and may contact customer services).

Hopefully someone here has any other idea why the Idp is not
responding from our SP's query. Would it be possible
also that the Idp has logs to refer to and confirm that we (SP) are
sending the X509Certificate correctly? Or any ideas
that you may have to troubleshoot the problem as I am already
frustrated for a week.

Your help is greatly appreciated.

Thank you.

ps:

* Idp's login page uses a self-generated certificate. In my browser, it says:
The security certificate presented by this website was not issued by a
trusted certificate authority.
The security certificate presented by this website was issued for a
different website's address.
I am assuming that this is normal and I can continue to their login page anyway.

* The Idp does not have any federation yet so I also added their
federation in the
   discovery page - both of them are new.