How do I change the certificate on an IDP web server?

[Nate Klingenstein]

Chloe,

The backchannel for queries between the IdP and the SP is mutually authenticated.  The actual tunnel runs between the SP and the web server protecting the IdP's SOAP port, typically 8443.

We've solved the web server's mistrust of your SP, but your SP will need to trust the certificate the web server is presenting.  This certificate needs to either be present in your IdP's metadata, or the SP must be able to perform successful PKIX validation of the certificate. In this event, neither was possible, so the connection didn't succeed.

Best to ensure the new SOAP port certificate is in the IdP's metadata and otherwise used by the IdP as configured in relying-party.xml.

Let us know if you have more questions,
Nate.

Semt frim mt iPone

On Jul 24, 2012, at 14:43, "CHLOE SOWERS (BLOOMBERG/ 731 LEXIN)" <csowers at bloomberg.net> wrote:

> How do I change the certificate on an IDP web server?
> 
> I tried to change the certificate on the web server that hosts the IDP, but it gave an error in the SP. Both IDP and SP are behind Apache. The web server certificate is signed for a production server, but I am testing it on a development server. The browser gives the expected warning that the name does not match, which is OK. After credentials are entered, it is passed back to the SP and "Internal Server Error. Please contact the site administrator." is displayed in the browser. 
> 
> * Shibboleth SP 2.4.2
> * The IDP web certificate is changed and Apache recycled.
> * SP is recycled too.
> * The IDP metadata is freshly loaded into the SP. Viewing the backing file on SP shows same cert IDP is using in relying-party.xml:
>  <security:Credential id="IdPCredential" xsi:type="security:X509Filesystem">
>    <security:PrivateKey>/path/to/sso.key</securit$
>    <security:Certificate>/path/to/sso.crt</securi$
> * SP shibboleth2.xml:
>        <MetadataProvider type="XML" uri="https://sso.dev.company.com/idp/profile/Metadata/SAML"
>               reloadInterval="7200" backingFilePath="fedmetadata.xml">
> * Tried the following in the SP shibboleth2.xml:
>        <!--TrustEngine type="Chaining">
>            <TrustEngine type="ExplicitKey"/>
>            <TrustEngine type="PKIX"/>
>        </TrustEngine-->
>        <!--TrustEngine type="StaticPKIX" verifyDepth="1" certificate="D:/tmp/sso.prod.crt" 
>            checkRevocation="off"/-->
> * Tried the these settings in the SP Apache (and recycled)
>  SSLVerifyClient optional_no_ca
>  SSLVerifyDepth  10
> * Tried setting errorFatal=false for all items in security-policy.xml:
>        <PolicyRule type="ClientCertAuth" errorFatal="false"/>
>        <PolicyRule type="XMLSigning" errorFatal="false"/>
>        <PolicyRule type="SimpleSigning" errorFatal="false"/>
>        <PolicyRule type="XMLSigning" errorFatal="false"/>
> 
> No errors in IDP log.
> 
> SP log:
> 
> <-1>[shibd] DEBUG [[1]] XMLTooling.TrustEngine.PKIX - unable to match DN, trying TLS subjectAltName match
> <-1>[shibd] DEBUG [[1]] XMLTooling.TrustEngine.PKIX - unable to match subjectAltName, trying TLS CN match
> <-5>[shibd] ERROR [[1]] XMLTooling.TrustEngine.PKIX - certificate name was not acceptable
> <-5>[shibd] ERROR [[1]] XMLTooling.SOAPTransport.CURL - supplied TrustEngine failed to validate SSL/TLS server certificate
> <-1>[shibd] DEBUG [[1]] XMLTooling.libcurl - SSLv3, TLS alert, Server hello (2):
> <-1>[shibd] DEBUG [[1]] XMLTooling.libcurl - SSL certificate problem, verify that the CA cert is OK. Details:
> error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
> <-1>[shibd] DEBUG [[1]] XMLTooling.libcurl - Closing connection #0
> <-5>[shibd] ERROR [[1]] Shibboleth.ArtifactResolver - exception resolving SAML 2.0 artifact: CURLSOAPTransport failed while contacting SOAP endpoint (https://sso.dev.company.com/idp/profile/SAML2/SOAP/ArtifactResolution): SSL certificate problem, verify that the CA cert is OK. Details:
> error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net