login.config to use private-CA-issued certificate

[Christopher Bongaarts]

On 7/29/2013 7:16 PM, David Bantz wrote:
> Caused by: javax.net.ssl.SSLHandshakeException: 
> sun.security.validator.ValidatorException: PKIX path building failed: 
> sun.security.provider.certpath.SunCertPathBuilderException: unable to 
> find valid certification path to requested target
> ...
>
> /What are the possible sources of this failure other than having been 
> provided the wrong certificate for the server? Do I ALSO need to 
> import the issuing CA certificate?  Use a different certificate file 
> format? .../

If there are intermediate certificates in the chain that the server is 
using, and their server is not configured to send the intermediate certs 
during SSL negotiation, and you're only trusting the root CA, then this 
can happen.

You can work around it by adding the intermediate(s) to your cert store, 
but the proper fix is for the server folks to configure SSL to send the 
chain (assuming this is the problem).

-- 
%%  Christopher A. Bongaarts   %%  cab at umn.edu          %%
%%  OIT - Identity Management  %%  http://umn.edu/~cab  %%
%%  University of Minnesota    %%  +1 (612) 625-1809    %%

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130730/3de01c86/attachment-0001.html