SP randomly failed to validate certificate IDP certicate.

[DE VEGA BARREIRO, Manuel (Manuel)]

Hi Ian,

the problem is not related to the socket connection closed situation, because it happens in both cases.

regards

________________________________
De: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] En nombre de Ian Young
Enviado el: martes, 26 de junio de 2012 17:01
Para: Shib Users
Asunto: Re: SP randomly failed to validate certificate IDP certicate.


On 26 Jun 2012, at 15:35, DE VEGA BARREIRO, Manuel (Manuel) wrote:

I can't help but notice a difference between the two samples:


Authentication and profile exchange between IDP and SP works fine, but time to time SP client refuse to accept IDP certificate:

2012-06-26 12:29:49 DEBUG XMLTooling.SOAPTransport.CURL [91]: sending SOAP message to https://10.122.4.76:7122/coi-idp/AA
2012-06-26 12:29:49 DEBUG XMLTooling.libcurl [91]: About to connect() to 10.122.4.76 port 7122
2012-06-26 12:29:49 DEBUG XMLTooling.libcurl [91]:   Trying 10.122.4.76...
2012-06-26 12:29:49 DEBUG XMLTooling.libcurl [91]: connected

[...]

I'm sure that certificate are ok, because most of the time SP accept it without any complains:

2012-06-26 12:13:28 DEBUG XMLTooling.SOAPTransport.CURL [86]: sending SOAP message to https://10.122.4.76:7122/coi-idp/AA
2012-06-26 12:13:28 DEBUG XMLTooling.libcurl [86]: Connection 0 seems to be dead!
2012-06-26 12:13:28 DEBUG XMLTooling.libcurl [86]: Closing connection #0
2012-06-26 12:13:28 DEBUG XMLTooling.libcurl [86]: About to connect() to 10.122.4.76 port 7122
2012-06-26 12:13:28 DEBUG XMLTooling.libcurl [86]:   Trying 10.122.4.76...
2012-06-26 12:13:28 DEBUG XMLTooling.libcurl [86]: connected

So in these two particular cases, the SP was in a different state with respect to having previously communicated with the IdP.  It's conceivable this is related to your problem.  I'd suggest that if you have lots more logs you try looking through them for all occurrences, and see if this difference is consistent between the "good" and "bad" cases.

I'm not saying it will tell us what the problem is, but it might be a clue.

                    -- Ian



-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20120627/976a0d63/attachment.html