Authenticate via Shibboleth and LDAP

[Cantor, Scott]

On 6/18/12 6:34 AM, "Stephan Hackstedt" <stephan.hackstedt at googlemail.com>
wrote:
>
>the problem was, that when enabled clientAuth, the Client (Browser) needs
>a PKAS Certificate.

No, it doesn't. Setting it to "want" means it's optional. And you haven't
addressed the fact that all your access should be to port 443 and the
client TLS is on port 8443 so they don't have any overlap anyway.

>So I created one from the idp.jks file with openssl, added it to firefox
>certificates and now it works.

That isn't why it works.

>I'm wondering why SSLCertificateFile and SSLCertificateKeyFile don't have
>a effect on the redirecting procedure.

Because that has nothing to do with your client. That's the server's
certificate.

-- Scott