IdP & LDAP source using private CA

[Peter Schober]

* David Bantz <dabantz at alaska.edu> [2013-04-15 21:19]:
> But failover does not appear to cover the case of connection failure
> due to untrusted certificate:
> the attribute-resolver aborts encountering an untrusted certificate;
> in fact the IdP startup process itself aborts encountering untrusted
> certificate in the DataConnector.
> 
> Am I missing something, or is it just the case that receiving an
> untrusted certificate in a connector is a fatal error for the IdP?

If you need to go through all that trouble to avoid untrustworthy
certificates of your own making you're Doing It Wrong. The whole
purpose of a private CA should be to get out of the cycle of paying
for forced renewals (and sub-CAs changing and taking all your certs
with you), optionally making the certs longer-lived and being done
with it.
Put that custom CA into your JVM truststore, done.

If you think it's any easier, buy commercial certs (in European and US
R&E space you can get flat-fee certs via TERENA or InCommon,
respectively) which basically requirs you do to exactly the same, as
you'll have to stick the missing intermediary CA certs in the JVM's
trust path, even though part of the trust anchors will already be in
the JVM.

For completeness: If you think a switched internal network will
provide sufficient protection from local evildoers (just saying) you
have the option of not using TLS at all.

But given complete failure of all campus/enterprise applications
connecting to the directory due to the MS directory product admins
simply nuking the trust chain without warning, I'd feel pretty relaxed
about the IDP being one of those things failing.
-peter