How do I change the certificate of a Shibboleth service provider?

Mon Jul 23 17:27:46 EDT 2012

> With Apache, you can handle this with SSLVerifyClient optional_no_ca.   
There are several examples on the web, but it's not an officially  
supported deployment configuration.

Thanks, I did find these entries, which I commented:
  # SSLVerifyClient optional
  # SSLVerifyDepth  10

However it only produced these errors. I will try the optional_no_ca next.

SP Log:

<-5>[shibd] ERROR [[1]] OpenSAML.SOAPClient - SOAP client detected a SAML error: (urn:oasis:names:tc:SAML:2.0:status:Responder) (Message did not meet security requirements)
<-5>[apache-shibd] ERROR [[8548] shib_handler] Shibboleth.Listener - remoted message returned an error: Identity provider returned a SAML error in response to artifact.
<-5>[apache-shibd] ERROR [[8548] shib_handler] Shibboleth.Apache - Identity provider returned a SAML error in response to artifact.
<-5>[apache-shibd] ERROR [[8548] shib_handler] Shibboleth.ServiceProvider - sendError could not process error template (?/Packages/shibboleth-sp/)
<13>Jul 23 16:50:56 MACHINE01 [apache-error]: [Mon Jul 23 16:50:56 2012] [error] [client 172.17.87.25] Identity provider returned a SAML error in response to artifact., referer: https://sso.dev.company.com/idp/Authn/BB
<13>Jul 23 16:50:56 MACHINE01 [apache-access]: 172.17.87.25 - - [23/Jul/2012:16:50:56 -0400] "GET /Shibboleth.sso/SAML2/Artifact?SAMLart=AAQAAilRUvukmNDw%2FD8AieE4yB8yYju6Xo34hIbr2UUIsuUUfCLKVWypguo%3D&RelayState=ss%3Amc%3A3d000e446f3b801ba13c7419c875122e HTTP/1.1" 156262 500 61 "https://sso.dev.company.com/idp/Authn/BB" "Mozilla/5.0 (Windows NT 5.1) AppleWebKit/535.19 (KHTML, like Gecko) Chrome/18.0.1025.151 Safari/535.19"

IDP Log:

16:50:56.672 - INFO [org.opensaml.ws.security.provider.ClientCertAuthRule:103] - Inbound message transport did not contain a peer credential, skipping client certificate authentication
16:50:56.673 - ERROR [org.opensaml.ws.security.provider.MandatoryAuthenticatedMessageRule:36] - Inbound message issuer was not authenticated.
16:50:56.682 - WARN [edu.internet2.middleware.shibboleth.idp.profile.saml2.ArtifactResolution:197] - Message did not meet security requirements
org.opensaml.ws.security.SecurityPolicyException: Inbound message issuer was not authenticated.
...
16:50:56.694 - DEBUG [org.opensaml.ws.message.encoder.BaseMessageEncoder:87] - Marshalling message
16:50:56.703 - DEBUG [PROTOCOL_MESSAGE:64] -
<?xml version="1.0" encoding="UTF-8"?><soap11:Envelope xmlns:soap11="http://schemas.xmlsoap.org/soap/envelope/">
   <soap11:Body>
      <saml2p:ArtifactResponse xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol" ID="_148ac5e21155909e7bef7da7483bc385" InResponseTo="_264a655163c4d34964e12018ef6836f8" IssueInstant="2012-07-23T20:50:56.692Z" Version="2.0">
         <saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:company:sso:idp</saml2:Issuer>
         <saml2p:Status>
            <saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Responder">
               <saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:RequestDenied"/>
            </saml2p:StatusCode>
            <saml2p:StatusMessage>Message did not meet security requirements</saml2p:StatusMessage>
         </saml2p:Status>
      </saml2p:ArtifactResponse>
   </soap11:Body>
</soap11:Envelope>