Problems changing IDP certificates

Thu Sep 12 12:50:32 EDT 2013

Here's a more crompehensive stack trace:

16:42:31.983 - TRACE
[edu.internet2.middleware.shibboleth.common.config.BaseService:191] - Full
stacktrace is:
org.opensaml.util.resource.ResourceException: Unable to load Spring bean
registry with configuration resources
        at
edu.internet2.middleware.shibboleth.common.config.SpringConfigurationUtils.populateRegistry(SpringConfigurationUtils.java:91)
~[shibboleth-common-1.4.0.jar:na]
        at
edu.internet2.middleware.shibboleth.common.config.BaseService.loadContext(BaseService.java:170)
~[shibboleth-common-1.4.0.jar:na]
        at
edu.internet2.middleware.shibboleth.common.config.BaseReloadableService.initialize(BaseReloadableService.java:148)
[shibboleth-common-1.4.0.jar:na]
        at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
~[na:1.7.0_03]
        at
sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
~[na:1.7.0_03]
        at
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
~[na:1.7.0_03]
        at java.lang.reflect.Method.invoke(Method.java:601) ~[na:1.7.0_03]
        at
org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.invokeCustomInitMethod(AbstractAutowireCapableBeanFactory.java:1414)
[spring-beans-2.5.6.SEC03.jar:2.5.6.SEC03]
        at
org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.invokeInitMethods(AbstractAutowireCapableBeanFactory.java:1375)
[spring-beans-2.5.6.SEC03.jar:2.5.6.SEC03]
        at
org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.initializeBean(AbstractAutowireCapableBeanFactory.java:1335)
[spring-beans-2.5.6.SEC03.jar:2.5.6.SEC03]
        at
org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:473)
[spring-beans-2.5.6.SEC03.jar:2.5.6.SEC03]
        at
org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory$1.run(AbstractAutowireCapableBeanFactory.java:409)
[spring-beans-2.5.6.SEC03.jar:2.5.6.SEC03]
        at java.security.AccessController.doPrivileged(Native Method)
[na:1.7.0_03]
        at
org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:380)
[spring-beans-2.5.6.SEC03.jar:2.5.6.SEC03]
        at
org.springframework.beans.factory.support.AbstractBeanFactory$1.getObject(AbstractBeanFactory.java:264)
[spring-beans-2.5.6.SEC03.jar:2.5.6.SEC03]
        at
org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:222)
[spring-beans-2.5.6.SEC03.jar:2.5.6.SEC03]
        at
org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:261)
[spring-beans-2.5.6.SEC03.jar:2.5.6.SEC03]
        at
org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:185)
[spring-beans-2.5.6.SEC03.jar:2.5.6.SEC03]
        at
org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:164)
[spring-beans-2.5.6.SEC03.jar:2.5.6.SEC03]
        at
org.springframework.beans.factory.support.DefaultListableBeanFactory.preInstantiateSingletons(DefaultListableBeanFactory.java:429)
[spring-beans-2.5.6.SEC03.jar:2.5.6.SEC03]
        at
org.springframework.context.support.AbstractApplicationContext.finishBeanFactoryInitialization(AbstractApplicationContext.java:728)
[spring-context-2.5.6.SEC03.jar:2.5.6.SEC03]
        at
org.springframework.context.support.AbstractApplicationContext.refresh(AbstractApplicationContext.java:380)
[spring-context-2.5.6.SEC03.jar:2.5.6.SEC03]
        at
org.springframework.web.context.ContextLoader.createWebApplicationContext(ContextLoader.java:255)
[spring-web-2.5.6.SEC03.jar:2.5.6.SEC03]
        at
org.springframework.web.context.ContextLoader.initWebApplicationContext(ContextLoader.java:199)
[spring-web-2.5.6.SEC03.jar:2.5.6.SEC03]
        at
org.springframework.web.context.ContextLoaderListener.contextInitialized(ContextLoaderListener.java:45)
[spring-web-2.5.6.SEC03.jar:2.5.6.SEC03]
        at
org.eclipse.jetty.server.handler.ContextHandler.callContextInitialized(ContextHandler.java:780)
[jetty-server-9.0.3.v20130506.jar:9.0.3.v20130506]
        at
org.eclipse.jetty.servlet.ServletContextHandler.callContextInitialized(ServletContextHandler.java:425)
[jetty-servlet-9.0.3.v20130506.jar:9.0.3.v20130506]
        at
org.eclipse.jetty.server.handler.ContextHandler.startContext(ContextHandler.java:772)
[jetty-server-9.0.3.v20130506.jar:9.0.3.v20130506]
        at
org.eclipse.jetty.servlet.ServletContextHandler.startContext(ServletContextHandler.java:275)
[jetty-servlet-9.0.3.v20130506.jar:9.0.3.v20130506]
        at
org.eclipse.jetty.webapp.WebAppContext.startContext(WebAppContext.java:1321)
[jetty-webapp-9.0.3.v20130506.jar:9.0.3.v20130506]
        at
org.eclipse.jetty.server.handler.ContextHandler.doStart(ContextHandler.java:724)
[jetty-server-9.0.3.v20130506.jar:9.0.3.v20130506]
        at
org.eclipse.jetty.webapp.WebAppContext.doStart(WebAppContext.java:490)
[jetty-webapp-9.0.3.v20130506.jar:9.0.3.v20130506]
        at
org.eclipse.jetty.util.component.AbstractLifeCycle.start(AbstractLifeCycle.java:69)
[jetty-util-9.0.3.v20130506.jar:9.0.3.v20130506]
        at
org.eclipse.jetty.deploy.bindings.StandardStarter.processBinding(StandardStarter.java:39)
[jetty-deploy-9.0.3.v20130506.jar:9.0.3.v20130506]
        at
org.eclipse.jetty.deploy.AppLifeCycle.runBindings(AppLifeCycle.java:186)
[jetty-deploy-9.0.3.v20130506.jar:9.0.3.v20130506]
        at
org.eclipse.jetty.deploy.DeploymentManager.requestAppGoal(DeploymentManager.java:495)
[jetty-deploy-9.0.3.v20130506.jar:9.0.3.v20130506]
        at
org.eclipse.jetty.deploy.DeploymentManager.addApp(DeploymentManager.java:146)
[jetty-deploy-9.0.3.v20130506.jar:9.0.3.v20130506]
        at
org.eclipse.jetty.deploy.providers.ScanningAppProvider.fileAdded(ScanningAppProvider.java:175)
[jetty-deploy-9.0.3.v20130506.jar:9.0.3.v20130506]
        at
org.eclipse.jetty.deploy.providers.ScanningAppProvider$1.fileAdded(ScanningAppProvider.java:64)
[jetty-deploy-9.0.3.v20130506.jar:9.0.3.v20130506]
        at org.eclipse.jetty.util.Scanner.reportAddition(Scanner.java:605)
[jetty-util-9.0.3.v20130506.jar:9.0.3.v20130506]
        at
org.eclipse.jetty.util.Scanner.reportDifferences(Scanner.java:528)
[jetty-util-9.0.3.v20130506.jar:9.0.3.v20130506]
        at org.eclipse.jetty.util.Scanner.scan(Scanner.java:391)
[jetty-util-9.0.3.v20130506.jar:9.0.3.v20130506]
        at org.eclipse.jetty.util.Scanner.doStart(Scanner.java:313)
[jetty-util-9.0.3.v20130506.jar:9.0.3.v20130506]
        at
org.eclipse.jetty.util.component.AbstractLifeCycle.start(AbstractLifeCycle.java:69)
[jetty-util-9.0.3.v20130506.jar:9.0.3.v20130506]
        at
org.eclipse.jetty.deploy.providers.ScanningAppProvider.doStart(ScanningAppProvider.java:145)
[jetty-deploy-9.0.3.v20130506.jar:9.0.3.v20130506]
        at
org.eclipse.jetty.util.component.AbstractLifeCycle.start(AbstractLifeCycle.java:69)
[jetty-util-9.0.3.v20130506.jar:9.0.3.v20130506]
        at
org.eclipse.jetty.deploy.DeploymentManager.startAppProvider(DeploymentManager.java:557)
[jetty-deploy-9.0.3.v20130506.jar:9.0.3.v20130506]
        at
org.eclipse.jetty.deploy.DeploymentManager.doStart(DeploymentManager.java:232)
[jetty-deploy-9.0.3.v20130506.jar:9.0.3.v20130506]
        at
org.eclipse.jetty.util.component.AbstractLifeCycle.start(AbstractLifeCycle.java:69)
[jetty-util-9.0.3.v20130506.jar:9.0.3.v20130506]
        at
org.eclipse.jetty.util.component.ContainerLifeCycle.start(ContainerLifeCycle.java:108)
[jetty-util-9.0.3.v20130506.jar:9.0.3.v20130506]
        at org.eclipse.jetty.server.Server.start(Server.java:342)
[jetty-server-9.0.3.v20130506.jar:9.0.3.v20130506]
        at
org.eclipse.jetty.util.component.ContainerLifeCycle.doStart(ContainerLifeCycle.java:90)
[jetty-util-9.0.3.v20130506.jar:9.0.3.v20130506]
        at
org.eclipse.jetty.server.handler.AbstractHandler.doStart(AbstractHandler.java:58)
[jetty-server-9.0.3.v20130506.jar:9.0.3.v20130506]
        at org.eclipse.jetty.server.Server.doStart(Server.java:290)
[jetty-server-9.0.3.v20130506.jar:9.0.3.v20130506]
        at
org.eclipse.jetty.util.component.AbstractLifeCycle.start(AbstractLifeCycle.java:69)
[jetty-util-9.0.3.v20130506.jar:9.0.3.v20130506]
        at
org.eclipse.jetty.xml.XmlConfiguration$1.run(XmlConfiguration.java:1236)
[jetty-xml-9.0.3.v20130506.jar:9.0.3.v20130506]
        at java.security.AccessController.doPrivileged(Native Method)
[na:1.7.0_03]
        at
org.eclipse.jetty.xml.XmlConfiguration.main(XmlConfiguration.java:1160)
[jetty-xml-9.0.3.v20130506.jar:9.0.3.v20130506]
Caused by: org.springframework.beans.factory.BeanDefinitionStoreException:
Unexpected exception parsing XML document from
/opt/drutt/shibboleth/conf/relying-party.xml; nested exception is
org.springframework.beans.FatalBeanException: Unable to create X509
credential, unable to parse certificates; nested exception is
java.security.cert.CertificateException: Unable to decode X.509 certificates
        at
org.springframework.beans.factory.xml.XmlBeanDefinitionReader.doLoadBeanDefinitions(XmlBeanDefinitionReader.java:420)
~[spring-beans-2.5.6.SEC03.jar:2.5.6.SEC03]
        at
org.springframework.beans.factory.xml.XmlBeanDefinitionReader.loadBeanDefinitions(XmlBeanDefinitionReader.java:342)
~[spring-beans-2.5.6.SEC03.jar:2.5.6.SEC03]
        at
org.springframework.beans.factory.xml.XmlBeanDefinitionReader.loadBeanDefinitions(XmlBeanDefinitionReader.java:310)
~[spring-beans-2.5.6.SEC03.jar:2.5.6.SEC03]
        at
org.springframework.beans.factory.support.AbstractBeanDefinitionReader.loadBeanDefinitions(AbstractBeanDefinitionReader.java:143)
~[spring-beans-2.5.6.SEC03.jar:2.5.6.SEC03]
        at
edu.internet2.middleware.shibboleth.common.config.SpringConfigurationUtils.populateRegistry(SpringConfigurationUtils.java:89)
~[shibboleth-common-1.4.0.jar:na]
        ... 57 common frames omitted
Caused by: org.springframework.beans.FatalBeanException: Unable to create
X509 credential, unable to parse certificates; nested exception is
java.security.cert.CertificateException: Unable to decode X.509 certificates
        at
edu.internet2.middleware.shibboleth.common.config.security.AbstractX509CredentialBeanDefinitionParser.parseCertificates(AbstractX509CredentialBeanDefinitionParser.java:120)
~[shibboleth-common-1.4.0.jar:na]
        at
edu.internet2.middleware.shibboleth.common.config.security.AbstractX509CredentialBeanDefinitionParser.doParse(AbstractX509CredentialBeanDefinitionParser.java:73)
~[shibboleth-common-1.4.0.jar:na]
        at
org.springframework.beans.factory.xml.AbstractSingleBeanDefinitionParser.doParse(AbstractSingleBeanDefinitionParser.java:139)
~[spring-beans-2.5.6.SEC03.jar:2.5.6.SEC03]
        at
org.springframework.beans.factory.xml.AbstractSingleBeanDefinitionParser.parseInternal(AbstractSingleBeanDefinitionParser.java:84)
~[spring-beans-2.5.6.SEC03.jar:2.5.6.SEC03]
        at
org.springframework.beans.factory.xml.AbstractBeanDefinitionParser.parse(AbstractBeanDefinitionParser.java:56)
~[spring-beans-2.5.6.SEC03.jar:2.5.6.SEC03]
        at
edu.internet2.middleware.shibboleth.common.config.BaseSpringNamespaceHandler.parse(BaseSpringNamespaceHandler.java:92)
~[shibboleth-common-1.4.0.jar:na]
        at
edu.internet2.middleware.shibboleth.common.config.SpringConfigurationUtils.createBeanDefinition(SpringConfigurationUtils.java:181)
~[shibboleth-common-1.4.0.jar:na]
        at
edu.internet2.middleware.shibboleth.common.config.SpringConfigurationUtils.parseInnerCustomElement(SpringConfigurationUtils.java:105)
~[shibboleth-common-1.4.0.jar:na]
        at
edu.internet2.middleware.shibboleth.common.config.SpringConfigurationUtils.parseInnerCustomElements(SpringConfigurationUtils.java:121)
~[shibboleth-common-1.4.0.jar:na]
        at
edu.internet2.middleware.shibboleth.common.config.relyingparty.RelyingPartyGroupBeanDefinitionParser.parseSecurityConfiguration(RelyingPartyGroupBeanDefinitionParser.java:102)
~[shibboleth-common-1.4.0.jar:na]
        at
edu.internet2.middleware.shibboleth.common.config.relyingparty.RelyingPartyGroupBeanDefinitionParser.doParse(RelyingPartyGroupBeanDefinitionParser.java:63)
~[shibboleth-common-1.4.0.jar:na]
        at
org.springframework.beans.factory.xml.AbstractSingleBeanDefinitionParser.parseInternal(AbstractSingleBeanDefinitionParser.java:84)
~[spring-beans-2.5.6.SEC03.jar:2.5.6.SEC03]
        at
org.springframework.beans.factory.xml.AbstractBeanDefinitionParser.parse(AbstractBeanDefinitionParser.java:56)
~[spring-beans-2.5.6.SEC03.jar:2.5.6.SEC03]
        at
edu.internet2.middleware.shibboleth.common.config.BaseSpringNamespaceHandler.parse(BaseSpringNamespaceHandler.java:92)
~[shibboleth-common-1.4.0.jar:na]
        at
org.springframework.beans.factory.xml.BeanDefinitionParserDelegate.parseCustomElement(BeanDefinitionParserDelegate.java:1297)
~[spring-beans-2.5.6.SEC03.jar:2.5.6.SEC03]
        at
org.springframework.beans.factory.xml.BeanDefinitionParserDelegate.parseCustomElement(BeanDefinitionParserDelegate.java:1287)
~[spring-beans-2.5.6.SEC03.jar:2.5.6.SEC03]
        at
org.springframework.beans.factory.xml.DefaultBeanDefinitionDocumentReader.parseBeanDefinitions(DefaultBeanDefinitionDocumentReader.java:141)
~[spring-beans-2.5.6.SEC03.jar:2.5.6.SEC03]
        at
org.springframework.beans.factory.xml.DefaultBeanDefinitionDocumentReader.registerBeanDefinitions(DefaultBeanDefinitionDocumentReader.java:92)
~[spring-beans-2.5.6.SEC03.jar:2.5.6.SEC03]
        at
org.springframework.beans.factory.xml.XmlBeanDefinitionReader.registerBeanDefinitions(XmlBeanDefinitionReader.java:507)
~[spring-beans-2.5.6.SEC03.jar:2.5.6.SEC03]
        at
org.springframework.beans.factory.xml.XmlBeanDefinitionReader.doLoadBeanDefinitions(XmlBeanDefinitionReader.java:398)
~[spring-beans-2.5.6.SEC03.jar:2.5.6.SEC03]
        ... 61 common frames omitted
Caused by: java.security.cert.CertificateException: Unable to decode X.509
certificates
        at
org.opensaml.xml.security.x509.X509Util.decodeCertificate(X509Util.java:354)
~[xmltooling-1.4.0.jar:na]
        at
edu.internet2.middleware.shibboleth.common.config.security.AbstractX509CredentialBeanDefinitionParser.parseCertificates(AbstractX509CredentialBeanDefinitionParser.java:109)
~[shibboleth-common-1.4.0.jar:na]
        ... 80 common frames omitted
Caused by: java.security.cert.CertificateException: Unable to initialize,
java.io.IOException: DerInputStream.getLength(): lengthTag=29, too big.
        at sun.security.x509.X509CertImpl.<init>(X509CertImpl.java:199)
~[na:1.7.0_03]
        at
sun.security.provider.X509Factory.engineGenerateCertificate(X509Factory.java:97)
~[na:1.7.0_03]
        at
java.security.cert.CertificateFactory.generateCertificate(CertificateFactory.java:339)
~[na:1.7.0_03]
        at
org.apache.commons.ssl.KeyStoreBuilder.parse(KeyStoreBuilder.java:291)
~[not-yet-commons-ssl-0.3.9.jar:na]
        at
org.apache.commons.ssl.TrustMaterial.<init>(TrustMaterial.java:207)
~[not-yet-commons-ssl-0.3.9.jar:na]
        at
org.apache.commons.ssl.TrustMaterial.<init>(TrustMaterial.java:160)
~[not-yet-commons-ssl-0.3.9.jar:na]
        at
org.opensaml.xml.security.x509.X509Util.decodeCertificate(X509Util.java:351)
~[xmltooling-1.4.0.jar:na]
        ... 81 common frames omitted
Caused by: java.io.IOException: DerInputStream.getLength(): lengthTag=29,
too big.
        at
sun.security.util.DerInputStream.getLength(DerInputStream.java:561)
~[na:1.7.0_03]
        at sun.security.util.DerValue.<init>(DerValue.java:252)
~[na:1.7.0_03]
        at
sun.security.util.DerInputStream.getDerValue(DerInputStream.java:417)
~[na:1.7.0_03]
        at sun.security.x509.X509CertImpl.parse(X509CertImpl.java:1727)
~[na:1.7.0_03]
        at sun.security.x509.X509CertImpl.<init>(X509CertImpl.java:196)
~[na:1.7.0_03]
        ... 87 common frames omitted

On 12 September 2013 18:48, Byte Flinger <byteflinger at gmail.com> wrote:

> What do you mean Scott. Without Shibboleth being to read the certificate
> it cannot do anything. I just get Service Unavailable when the SP tries to
> redirect to Shibboleth with a SAML Request.
>
>
> On 12 September 2013 18:04, Cantor, Scott <cantor.2 at osu.edu> wrote:
>
>> On 9/12/13 10:56 AM, "Byte Flinger" <byteflinger at gmail.com> wrote:
>> >
>> >The certificate we are trying to use is created with SHA-256 and we have
>> >performed some tests and noticed that when we created certificates with
>> >SHA-1 it works.
>> >
>> >Is there some sort of limitation on Shibboleth that one needs to know
>> >about to use SHA-256 certificates?
>>
>> Nothing I'm aware of, but since the certificate is of no consequence when
>> the system is used as we intend, you could probably for now just file a
>> bug and move on.
>>
>> -- Scott
>>
>>
>> --
>> To unsubscribe from this list send an email to
>> users-unsubscribe at shibboleth.net
>>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130912/78369ad0/attachment-0001.html 