Shibboleth SP SSL3_GET_RECORD wrong version number

[Cantor, Scott]

On 5/30/12 12:29 AM, "Coeus[TM]" <coeus.ph at gmail.com> wrote:
>and on the Idp side:

There's nothing on the IdP side because the Apache server (I'm assuming)
is in the way long before the IdP sees any query.

>They said that the Authn Request from log posted above was followed by
>nothing which is unusual.

Do you and they understand the basic flow here? How SOAP is used and when?
If not, what can we do to document it better?

>On the other hand, I tried using our test sp (v2.4.3). I encountered
>no errors at all and the authentication was successful.

Authentication isn't relevant, the issue is TLS during the query afterward.

>I suspect that this is a certificate problem.

It's not. It's an SSL version problem between the libcurl on the SP end
and the Apache server (guessing again) on the IdP.

You can search for this error on the web and you'll find out anything I
could tell you. This is between libcurl and the web server at the other
end. The default libcurl settings used by the SP are for SSLv3 and TLS,
with pretty standard cipher suite rules.

>Both are running on an Apache http server with the same version.

It's the IdP and its mod_ssl configuration that's relevant, not the SP.

-- Scott