SSL Error: alert internal error

[Christopher Peters]

This is great information, I thank you guys much.

I will work on upgrading Java to 1.7 and possibly OpenSSL and see if that
fixes things.  We do have a rather old version of OpenSSL on the system,
and the related libraries. And, of course, an old version of Java.

I remember when we moved to v2.x we had a big issue with upgrading OpenSSL
breaking some service providers, and we had to work with them to get things
interoperable.  I don't even want to imagine the headaches moving again
would create.

Chris


On Mon, Jul 29, 2013 at 2:42 PM, Christopher Peters <cjpeters at uci.edu>wrote:

> You are correct about it being Tomcat native.  That was bad information on
> my part.  When I initially set up the IDP v1 server we used Apache through
> Tomcat, but when we migrated to 2.1.5 we went native Tomcat and I
> completely forgot about that change.
>
> --
>
> I think the bad cert issue is that we self-sign the cert.  It's only used
> through InCommon and in Metadata, so it doesn't need to go through
> verification.  We are aware it expires in 3 days, and that is why there is
> a second cert in InCommon Metadata which is soon to replace this one.
>
>
> On Mon, Jul 29, 2013 at 2:21 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:
>
>> I would add that if the server's headers are to be believed, that is *not*
>> Apache, it's Tomcat.
>>
>> So yes, I suspect you have an issue with the Java stack here, if that's in
>> fact the TLS implementation in use.
>>
>> Various TLS bugs hit in the middle of the 1.6 JDK cycle, I'd strongly
>> suggest moving to 1.7, or if absolutely necessary the latest 1.6 and go
>> from there.
>>
>> -- Scott
>>
>>
>> --
>> To unsubscribe from this list send an email to
>> users-unsubscribe at shibboleth.net
>>
>
>
>
> --
> Chris Peters
> Middleware Services Developer
> Office of Information Technology - NSP
> (949) 824-6845
> cjpeters at uci.edu
>



-- 
Chris Peters
Middleware Services Developer
Office of Information Technology - NSP
(949) 824-6845
cjpeters at uci.edu
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130729/d7bfc015/attachment.html