defending shib-idp after commercial cert installed for tomcat6

[Peter Schober]

* Gene Matthews <gmatthew at hitachi-cta.com> [2014-01-08 17:58]:
> We have a working shibboleth-idp (2.4.0) running under tomcat 6.0.24
> on CentOS 6.5. Tomcat had a self-signed cert (currently still does
> as we had to revert back to it). A commercial SSL cert was received
> and put in place on tomcat (with appropriate edits in the server.xml
> file) by someone other than me. With the commercial cert in place,
> tomcat starts ok with no error messages and indicates the idp starts
> up with no error messages. Tomcat connector (port 8443) also starts
> up and a netstat shows something listening on that port.

>From this it's unclear to me who/what handles TLS on port 443. Tomcat?
Something else?
In the simple case Tomcat does TLS on port 443 as an ordinary
webserver, with a CA-signed certificate. You'll have a Connector for
that in your server.xml
It may also have another, different Connector for attribute queries
from SPs (not end-user's browsers). That's something else entirely,
requires special configuration (detailed in the preparing tomcat wiki
page) and has /nothing/ to do with your webserver certificate.

If you can live without attribute queries you can even disable the
port 8443. Just saying, it's something optional (technically, not in
every deployment).
-peter