XMLSecTool and TLSV1.1/1.2

[Wessel, Keith]

Thanks, Scott. But what it comes down to, if we're using Java 6 on our IDP, is that it won't be able to grab metadata from https URLs if the server hosting the metadata has TLS v1.0 disabled, correct?

The SSL hostname validation exception threw me since I was expecting a handshake exception. So, just making sure my above statement is true to our best guess before I put this little task on hold until Java 7 goes onto our IDP.

Keith


-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Friday, January 31, 2014 12:27 PM
To: Shib Users
Subject: Re: XMLSecTool and TLSV1.1/1.2

On 1/31/14, 12:52 PM, "Wessel, Keith" <kwessel at illinois.edu> wrote:
>
>I can certainly upgrade to Java 7 to get xmlsectool using the new
>protocols. But that won't do me much good if the IDP can't consume
>metadata from the SSL-enabled webserver, correct?

The IdP is just using Java's SSL code, AFAIK. Not directly, there are some
libraries there, but the underlying socket factory is just the regular one.

> Currently, with TLSv1.1 and 1.2 enabled on our test server where we
>distribute signed metadata over https, our IDP on a different server is
>attempting to retrieve that metadata and reporting:
>
>javax.net.ssl.SSLPeerUnverifiedException: SSL peer failed hostname
>validation for name: null

I don't think that's a TLS versioning issue unless something is just
throwing a spurious exception.

-- Scott


--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net