defending shib-idp after commercial cert installed for tomcat6

[Gene Matthews]

Hi, 

We have a working shibboleth-idp (2.4.0) running under tomcat 6.0.24 on CentOS 6.5. Tomcat had a self-signed cert (currently still does as we had to revert back to it). A commercial SSL cert was received and put in place on tomcat (with appropriate edits in the server.xml file) by someone other than me. With the commercial cert in place, tomcat starts ok with no error messages and indicates the idp starts up with no error messages. Tomcat connector (port 8443) also starts up and a netstat shows something listening on that port. 

I have captured idp-process.log file during a tomcat restart with both certs in place to compare and I don't see any errors indicated in either (they are identical except for timestamps as best I can tell). 

However, with commercial cert in place we can't get to our SSO login page from the redirect at the SP. Browsers give some less than useful generic SSL error. I don't see anything in the idp-process.log when that is attempted. Unfortunately, some here on our team think the issue lies within the shibboleth-idp configuration. I'm currently convinced it is a problem either with the certificate and/or keystore file and/or tomcat server.xml configuration. That said, I can barely spell shibboleth-idp and am not a tomcat expert either. My shibboleth-idp is only running because of much appreciated help from this list! 

My question to this list is this -- is there any way this could be a shibboleth-idp issue? I'm posting more detailed tomcat config on a tomcat users list as I'm convinced this is not a shib configuration problem but unfortunately, I've been wrong before.... 

Thanks for any insight! 

Gene 




-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20140108/61f96d43/attachment.html