defending shib-idp after commercial cert installed for tomcat6

[Gene Matthews]

>* Gene Matthews <gmatthew at hitachi-cta.com> [2014-01-08 19:49]:
>> Scott, can you elaborate more on this point please?  Tomcat
>> connector is for port 8443 and our SPs do redirect back to
>> https://<our sso server>:8443/...

>Unless you're saying that your normal webserver port intended for
>users' web browsers is 8443 this is wrong. That port is not intended
>for end users or SSO. If an SP sends your browser there your metadata
>is probaly wrong (assuming the SP consumed your metadata somehow).
>-peter

Peter,

End users go to the SP's site (port 443) which redirects back to our Idp (user sees https://<idp>:8443/idp/....  as the url in their browser) and there they see the idp login page.  Once they authenticate, Idp sends them back to SP (https/443).  That has been working for some time now with the self-signed cert referenced in tomcat's server.xml file.

There is the separate cert referenced in shibboleth-idp's relying-party.xml that points to /opt/shibboleth-idp/credentials/idp.crt.  

The only thing being changed is the self-signed cert referenced in tomcat's server.xml file.  When we put that in place, we see the browser fails to load the idp login page when the SP redirects to the Idp.  When this happens, I'm thinking it isn't making it past the tomcat connector as I don't see anything traffic in the idp-process.log. 

I hope that makes sense.

Thanks,

Gene