IdP failed to retrive metada (problem, possible solution, and good practice): javax.net.ssl.SSLPeerUnverifiedException: SSL peer failed hostname validation for name: null

[Christian Munive]

Hi. I was trying to configure a test IdP to retrieve my test federation
metadata, but it failed to download.

Here it is an extract of my relying-party.xml:

<metadata:MetadataProvider id="URLMD"
xsi:type="metadata:FileBackedHTTPMetadataProvider"
                          metadataURL="
https://cdsserver.inca.net.pe/metadata/inca-federation.xml"

backingFile="/opt/shibboleth-idp/metadata/inca-federation-metadata.xml">

...

<security:TrustEngine id="shibboleth.MetadataTrustEngine"
xsi:type="security:StaticExplicitKeySignature">
        <security:Credential id="MyFederation1Credentials"
xsi:type="security:X509Filesystem">

<security:Certificate>/opt/shibboleth-idp/credentials/inca.crt</security:Certificate>
        </security:Credential>
</security:TrustEngine>

But in my log I got the error:

javax.net.ssl.SSLPeerUnverifiedException: SSL peer failed hostname
validation for name: null

I thought that maybe if I could point Java (in JAVA_OPTS in
/etc/default/tomcat6) to the keystore from Shibboleth, and imported the
certificate into the keystore, that could do the trick. It did, the error
is gone, and the metadata from my test server is downloaded fine in my IdP.

My question is: Is this a bad practice? Is it ok to import certificate data
directly to a keystore file? Or is there a way to make Java "aware" of a
certain certificate, so the connection proceeds normally? Thanks in advance
for your time.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20140724/63fba337/attachment.html