Shibboleth + CAS 3.5.2 error

[Gianluigi Ruggeri]

Is possible to know the certificate that I need to include in my keystore?

I use apache + AJP connector to Tomcat where there is my Shibboleth Idp;
So, I setted SSL certificate in my Apache web server.
I have included this certificate also in my machine where is runned Shibboleth

I followed This example:

Keystore/TrustStore Reference

Import Trusted Certificate

By default the Java system truststore is at
$JAVA_HOME/jre/lib/security/cacerts. The certificate to be imported
MUST be a DER-encoded file. If the contents of the certificate file
are binary, it's likely DER-encoded; if the file begins with the text
---BEGIN CERTIFICATE---, it is PEM-encoded and needs to be converted
to DER encoding. The following example demonstrates a conversion
command using OpenSSL.

Convert PEM-encoded Cert to DER Encoding
openssl x509 -in etc/pki/incommon-root-cert.pem -out
tmp/incommon-root-cert.der -outform DER

Once the certificate file is properly in the DER-encoded format, it
may be imported using the keytool command.

Keytool Import Command
keytool -import -keystore $JAVA_HOME/jre/lib/security/cacerts -file
tmp/incommon-root-cert.der -alias incommon

List Trusted Certificates

keytool -v -list -keystore $JAVA_HOME/jre/lib/security/cacerts

is correct to include the certificate that I con figurated in Apache
---> in (Shibbolet tomcat) keystore?
or I need to import the shibbolet certificate in (CAS tomcat) keystore?

2013/12/2 Kevin P. Foote <kpfoote at iup.edu>:
>
> On Mon, 2 Dec 2013, Gianluigi Ruggeri wrote:
>
>> I have a question about Shibboleth + CAS 3.5.2
>> I followed this tutoria to configure my Shibboleth Idp.
>> https://wiki.jasig.org/display/CASUM/Shibboleth-CAS+Integration
>>
>> I can try the Idp using TestShib:
>>
>> I set my idp url ad I have a redirect to my CAS Server login Page.
>> I put my credentials: I'm authenticated but I'm redirected to error
>> page and I have this log error:
>>
>> 15:57:00.158 - ERROR [org.jasig.cas.client.util.CommonUtils:340] -
>> sun.security.validator.ValidatorException: PKIX path building failed:
>> sun.security.provider.certpath.SunCertPathBuilderException: unable to$
>> javax.net.ssl.SSLHandshakeException:
>> sun.security.validator.ValidatorException: PKIX path building failed:
>> sun.security.provider.certpath.SunCertPathBuilderException: unable to
>> find valid certification path$
>
>
> This is a CAS client error. You have to ensure that your SSL exchanges
> or permissions are correct for your CAS setup.
>
> The Shibboleth IdP cares nothing of this error and is just waiting for the
> REMOTE_USER to be filled in by your CAS client.
>
>
> ------
> thanks
>   kevin.foote
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net