Security Advisory 20120227

[Mark Cairney]

Hi,

There appears to be a problem with this and wildcard certificates- having tried it on one of our Test IDPs it bails out with the following error:

15:22:25.776 - ERROR [edu.vt.middleware.ldap.pool.DefaultLdapFactory:109] - unabled to connect to the ldap
javax.naming.CommunicationException: hostname of the server 'authorise-test.is.ed.ac.uk' does not match the hostname in the server's certificate.

The entry in Java's keystore reads:

Alias name: authorise-test
Creation date: Feb 27, 2012
Entry type: trustedCertEntry

Owner: EMAILADDRESS=ext6033 at ed.ac.uk, CN=*.authorise-test.is.ed.ac.uk, OU=Information Services, O=University of Edinburgh, L=Edinburgh, ST=Scotland, C=GB
Issuer: EMAILADDRESS=postmaster at ed.ac.uk, CN=The University of Edinburgh CA, OU=The University of Edinburgh, O=The University of Edinburgh, L=Edinburgh, ST=Scotland, C=GB
Serial number: ce3
Valid from: Thu Apr 28 14:20:45 BST 2011 until: Sun Apr 27 14:20:45 BST 2014

Is this expected behaviour and are you aware of any workarounds? This setup was working fine with Shibboleth 2.3.5..

Kind regards,

Mark


/********************************* 
Mark Cairney
ITI UNIX Section
Information Services
University of Edinburgh

Tel: 0131 650 6565
Email: mark.cairney at ed.ac.uk

*********************************/


-- 
The University of Edinburgh is a charitable body, registered in
Scotland, with registration number SC005336.