Anyone had success/failures with changing IdP IP addresses?

[Brian Koehmstedt]

We're trying to migrate to new hardware.

Months ago I put Tomcat and the IdP on the new hardware and had Apache 
on the original hardware proxy the requests to the Tomcat on the new 
machine.
This works just fine.
The last step is changing IPs so requests go through Apache on the new 
machine and not the old machine.
This change of IPs and Apache servers is proving to be the stubborn part.

When we change the DNS records to have our IdP hostname point to a new 
IP address, services start failing.  I've confirmed it's not a DNS cache 
issue.

One of my theories is that this is an SSL handshake problem.  (We're 
using the same key pair on old and new machine, but a newer Apache 
version.)  Perhaps older SPs are trying to use an SSL cipher that the 
modern Apache version is not allowing so SSL handshake fails? This seems 
like a reach though.

Has anyone else tried to do the same, faced the same problem, and have 
some tips for me?

It's difficult to figure out what's going on because I don't have access 
to any of the remote service providers.  We only have one local service 
provider, and it is ADFS, and that ADFS service works just fine post-DNS 
change.  I've also tested with a bilateral local SP and it works.  It's 
only the InCommon remotes that are failing (I'm not sure if it's ALL 
remotes not working or just some -- we typically test with our 5 most 
important SPs when we do the DNS change).

On https://shibboleth.net/about/basic.html
Steps 1 through 3 are happening, but either Step 4 or Step 5 isn't working.

I don't see any errors in my idp-process.log file when we attempt to do 
this.

I have contacted one SP and asked them to try and find errors in their 
log file on my behalf, but I wasn't able to obtain anything useful so I 
can't factually say what did or didn't happen on their end.