SSL Error: alert internal error

[Christopher Peters]

We are attempting to upgrade our IDP from 2.1.5 to 2.4.0.  I have changed
all the configuration using the recommendations on this page:

https://wiki.shibboleth.net/confluence/display/SHIB2/IdP22Upgrade

and for the most part it worked fine, but we had a half dozen service
providers who immediately started encountering an SSL error:

CURLSOAPTransport failed while contacting SOAP endpoint (
https://shib.nacs.uci.edu:8443/idp/profile/SAML1/SOAP/AttributeQuery):
error:14094438:SSL routines:SSL3_READ_BYTES:tlsv1 alert internal error

I won't go too in detail about our metadata and configuration, as it didn't
change (except the minor things listed in the upgrade page), but we use
Apache with a connector to Tomcat for attribute queries, and our metadata
is published through InCommon for all of these SPs.  Also, no software
other than the IDP changed.  We didn't upgrade SSL, Apache, Tomcat or
anything else.

I'm hoping someone has experienced this error and has an idea of what I
should be looking at.

Two further things I want to note:  1) we have two certificates in metadata
but only one can be specified in Tomcat configuration at a time, so I am
concerned that it fell back to the cert that is not configured.
2) some of the service providers continue to work just fine and retrieve
attributes without issue.  Is there a version of SP that I might look for
in common with this issue?

Thanks for your help!

-- 
Chris Peters
Middleware Services Developer
Office of Information Technology - NSP
(949) 824-6845
cjpeters at uci.edu
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130729/83be7a7f/attachment.html