Help with error:14094416:SSL routines:SSL3_READ_BYTES:sslv3 alert certificate unknown

[Coeus[TM]]

Hi,

It has been a while since the last activity for this topic.
Unfortunately, they have not provided me a snippet from their
logs.

But recently I also tested integrating another Idp which ended up
in a similar case.

Now, I am suspecting that from these lines below:

(from the previously reported):
2012-02-17 06:38:55 ERROR Shibboleth.AttributeResolver.Query [27]:
exception during SAML query to
https://idp-host1:8443/idp/profile/SAML1/SOAP/AttributeQuery:
CURLSOAPTransport failed while contacting SOAP responder:
error:14094416:SSL routines:SSL3_READ_BYTES:sslv3 alert certificate
unknown

(new Idp under testing):
2012-03-13 06:54:49 ERROR Shibboleth.AttributeResolver.Query [1]:
exception during SAML query to
https://idp-host2:8443/idp/profile/SAML1/SOAP/AttributeQuery:
CURLSOAPTransport failed while contacting SOAP responder:
error:140943F2:SSL routines:SSL3_READ_BYTES:sslv3 alert unexpected
message

I am running a Shibboleth SP ver. 2.1.0 but tries to connect to a SAML
1 endpoint where I believe these 2 different Idp's already defined an
SAML 2 endpoint in their metadata.

What should I need to reconfigure so that the SP will connect to the
SAML 2 endpoint?

Thanks!

On Wed, Feb 15, 2012 at 2:49 AM, Cantor, Scott <cantor.2 at osu.edu> wrote:
> On 2/14/12 9:10 PM, "Coeus[TM]" <coeus.ph at gmail.com> wrote:
>>
>>I only have the snippet below from their shibd.log
>
> That's an IdP log, and there's nothing the IdP can do about mod_ssl. There
> can be nothing in it by definition.
>
>>They also advised me to read the link below and suggested to apply the
>>workarounds (OpenSSL re-enable "unsafe" or upgrade or downgrade
>>version):
>>https://wiki.shibboleth.net/confluence/display/SHIB2/SSL+Renegotiation
>
> That causes timeouts, not certificate rejection.
>
> If they won't fix their IdP, then your only choice is to live with their
> restrictions on certificates and change what you're using, or switch to
> message signing.
>
> -- Scott
>
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net