login.config to use private-CA root certificate

[David Bantz]

> Date: Wed, 31 Jul 2013 17:11:08 +0200
> From: Peter Schober <peter.schober at univie.ac.at>
> Subject: Re: login.config to use private-CA-issued certificate
...
> 
> You said those server certs were issued by a private CA, I'm assuming
> the same one. Why not add that private CA as a trust anchor (via
> whatever mechanism) instead of adding server certs, which will break
> the next time someone decides to roll over a server cert (probably
> without telling you)?
> -peter

This works and will definitely be more convenient, extensible and robust !
I've marked my calendar for the CA certificate expiration in October 2060 %-}

Mea culpa for 'mis-under-estimating' the capabilities of VT's middleware.

On Wed, 31 Jul 2013, at 06:10 , Christopher Bongaarts <cab at umn.edu> wrote:

> Concatenate multiple CA certifcates into a single PEM file?

I did think of that, but read that while "legal" it is not always supported:

"In almost all cases, OpenSSL will assume that there's only one certificate in a given file. 
As such, it will generally only use the first certificate that it finds, and will ignore all others."
 <http://www.gagravarr.org/writing/openssl-certs/general.shtml>

db

login.config fragment:

ShibUserPassAuth {
...

// UA AD Auth
     edu.vt.middleware.ldap.jaas.LdapLoginModule sufficient
      ldapUrl="ldap://adua02.ua.ad.alaska.edu:3268 ldap://adua03.ua.ad.alaska.edu:3268"
      baseDn="dc=ua,dc=ad,dc=alaska,dc=edu"
      bindDn="cn=uashib,ou=uaf_service,ou=uaf,dc=ua,dc=ad,dc=alaska,dc=edu"
      bindCredential="•••••••••••"
      subtreeSearch="true"
// Directly reference imported certificate for CA used to create/sign UA AD server certs 
      sslSocketFactory="{trustCertificates=file:/opt/shibboleth-idp/trustedcerts/UA_AD_CA.pem}"
      ssl="false"
      tls="true"
      userField="sAMAccountName,uaIdentifier";

};

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130731/5d672b4b/attachment.html