XMLSecTool and TLSV1.1/1.2

[Cantor, Scott]

On 1/31/14, 12:52 PM, "Wessel, Keith" <kwessel at illinois.edu> wrote:
>
>I can certainly upgrade to Java 7 to get xmlsectool using the new
>protocols. But that won't do me much good if the IDP can't consume
>metadata from the SSL-enabled webserver, correct?

The IdP is just using Java's SSL code, AFAIK. Not directly, there are some
libraries there, but the underlying socket factory is just the regular one.

> Currently, with TLSv1.1 and 1.2 enabled on our test server where we
>distribute signed metadata over https, our IDP on a different server is
>attempting to retrieve that metadata and reporting:
>
>javax.net.ssl.SSLPeerUnverifiedException: SSL peer failed hostname
>validation for name: null

I don't think that's a TLS versioning issue unless something is just
throwing a spurious exception.

-- Scott