certificate name was not acceptable

[Pete Scott]

Greetings,

Note that I have moderate understanding of SP configuration and basically no understanding of IdP configurations.

Running a hosted SAAS with option to interface with various Shibboleth IdPs for user authentication. Each server in the hosting environment has Shibboleth SP installed (Windows x64). Multiple Shibboleth customers may be hosted on the same server (using Host Mapping and Application Override sections).

A particular IdP integration is causing some issues for us. After the user enters their credentials on the IdP, they are returned to our hosted solution. Following error is logged in shibd_warn:

2013-05-14 15:54:29 ERROR XMLTooling.TrustEngine.PKIX [76]: certificate name was not acceptable
2013-05-14 15:54:29 ERROR XMLTooling.SOAPTransport.CURL [76]: supplied TrustEngine failed to validate SSL/TLS server certificate
2013-05-14 15:54:29 ERROR Shibboleth.AttributeResolver.Query [76]: exception during SAML query to https://xxxxxxx/idp/profile/SAML2/SOAP/AttributeQuery: CURLSOAPTransport failed while contacting SOAP endpoint (https://xxxxxxx/idp/profile/SAML2/SOAP/AttributeQuery): SSL certificate problem, verify that the CA cert is OK. Details:
error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
2013-05-14 15:54:29 ERROR Shibboleth.AttributeResolver.Query [76]: unable to obtain a SAML response from attribute authority

The client believes this has something to do with us having a gap in our trust chain of the certificate in use on their https connection and is not connected to the certificate used in the metadata (which, incidentally, seems to match between the SP and the IdP, but I'm not certain I know the proper way to verify that). That seems strange to me, but all told it might be a non-issue; I'm not certain what is causing us to query for attributes-shouldn't we be getting those back when the client is returned to us? What might prevent that from occurring?

I'm unfortunately not knowledgeable enough to troubleshoot this particular issue, so any handholding here would be appreciated. =]

--
Pete Scott


-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130613/174f8a29/attachment.html