IDP config for load balanced AD servers with SSL (LDAPS)

[Yusuf Tran]

Hi Nate,
Regarding adding the certificate to the keystore, I've tried the following but I keep getting an error about srcstorepass even though the certificate has no password set:

keytool -importkeystore -srckeystore kicds.com.pfx -srcstoretype PKCS12 -destkeystore /opt/shibboleth-idp/credentials/idp.jks -deststoretype JKS -deststorepass xxxx

also tried -destkeystore /usr/java/jdk1.7.0_21/jre/lib/security/cacerts

I add the keystore password for idk.jks as the same password when first installing the IDP.

But I get the following error:

*****************  WARNING WARNING WARNING  *****************
* The integrity of the information stored in the srckeystore*
* has NOT been verified!  In order to verify its integrity, *
* you must provide the srckeystore password.                *
*****************  WARNING WARNING WARNING  *****************

keytool error: java.security.UnrecoverableKeyException: Get Key failed: null

Any ideas?

Yusuf

From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Nate Klingenstein
Sent: 08 June 2013 03:18
To: Shib Users
Subject: Re: IDP config for load balanced AD servers with SSL (LDAPS)

Yusuf,

This isn't really a Shibboleth question, but answers below.

Could you advise on the best strategy for creating and implementing the certificate(s)? I've seen guides to do this for one server but not 2 load balanced servers.

You can give them the same certificate and keypair as long as the hostname they use when communicating with the IdP matches the load balancer, just like you did for the IdPs and SPs.

The certificate will need to be trusted by the IdP's.  You can do that by adding it directly to the Java truststore, yes.


Will I need to do anything special like create a wildcard cert and try to use the same cert on both DC's?

No.  If they speak to the IdP's using different domain names, a subjectAltName is the most you will need to do.

Thanks,
Nate.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130609/fc4fb91d/attachment.html