CAS Cert Issues

Michael Dahlberg olgamirth at gmail.com
Sat Aug 1 11:29:30 EDT 2015 

We're running Shib IdP v.2.4.0, java 1.7.0.55 and tomcat 6.0.39 with the
CAS client libraries v. 3.2.1 (yes, I know some are a bit dated). We're
using CAS as the backend authentication mechanism installed as detailed in
https://wiki.jasig.org/display/CASUM/Shibboleth-CAS+Integration

This morning we updated the SSL certificate on the CAS server and
immediately Shib logins cease to function (if we move back to the old cert,
logins work).  We were using RapidSSL as our CA, now we're using InCommon.

I've tried replacing /usr/java/latest/jre/lib/security/cacerts with a
cacerts file from java 1.8

The error messages that we get in the IdP idp-process.log file are as
follows:

08:29:32.933 - ERROR [org.jasig.cas.client.util.CommonUtils:340] -
sun.security.validator.ValidatorException: PKIX path building failed:
sun.security.provider.certpath.SunCertPathBuilderException: unable to find
valid certification path to requested target
javax.net.ssl.SSLHandshakeException:
sun.security.validator.ValidatorException: PKIX path building failed:
sun.security.provider.certpath.SunCertPathBuilderException: unable to find
valid certification path to requested target
        at sun.security.ssl.Alerts.getSSLException(Alerts.java:192)
~[na:1.7.0_55]
        at sun.security.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1884)
~[na:1.7.0_55]
        at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:276)
~[na:1.7.0_55]
        at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:270)
~[na:1.7.0_55]
        at
sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1341)
~[na:1.7.0_55]
        at
sun.security.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:153)
~[na:1.7.0_55]
        at sun.security.ssl.Handshaker.processLoop(Handshaker.java:868)
~[na:1.7.0_55]
        at sun.security.ssl.Handshaker.process_record(Handshaker.java:804)
~[na:1.7.0_55]
        at
sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:1016)
~[na:1.7.0_55]
        at
sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1312)
~[na:1.7.0_55]
        at
sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1339)
~[na:1.7.0_55]
        at
sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1323)
~[na:1.7.0_55]
        at
sun.net.www.protocol.https.HttpsClient.afterConnect(HttpsClient.java:563)
~[na:1.7.0_55]
        at
sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(AbstractDelegateHttpsURLConnection.java:185)
~[na:1.7.0_55]
        at
sun.net.www.protocol.http.HttpURLConnection.getInputStream(HttpURLConnection.java:1300)
~[na:1.7.0_55]
        at
sun.net.www.protocol.https.HttpsURLConnectionImpl.getInputStream(HttpsURLConnectionImpl.java:254)
~[na:1.7.0_55]
        at
org.jasig.cas.client.util.CommonUtils.getResponseFromServer(CommonUtils.java:326)
[cas-client-core-3.2.1.jar:3.2.1]
        at
org.jasig.cas.client.util.CommonUtils.getResponseFromServer(CommonUtils.java:305)
[cas-client-core-3.2.1.jar:3.2.1]
        at
org.jasig.cas.client.validation.AbstractCasProtocolUrlBasedTicketValidator.retrieveResponseFromServer(AbstractCasProtocolUrlBasedTicketValidator.java:50)
[cas-client-core-3.2.1.jar:3.2.1]
        at
org.jasig.cas.client.validation.AbstractUrlBasedTicketValidator.validate(AbstractUrlBasedTicketValidator.java:207)
[cas-client-core-3.2.1.jar:3.2.1]
        at
org.jasig.cas.client.validation.AbstractTicketValidationFilter.doFilter(AbstractTicketValidationFilter.java:169)
[cas-client-core-3.2.1.jar:3.2.1]
        at
org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
[catalina.jar:6.0.39]
        at
org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
[catalina.jar:6.0.39]
        at
org.jasig.cas.client.authentication.AuthenticationFilter.doFilter(AuthenticationFilter.java:116)
[cas-client-core-3.2.1.jar:3.2.1]
        at
org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
[catalina.jar:6.0.39]
        at
org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
[catalina.jar:6.0.39]
        at
org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:219)
[catalina.jar:6.0.39]
        at
org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:191)
[catalina.jar:6.0.39]
        at
org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:127)
[catalina.jar:6.0.39]
        at
org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:103)
[catalina.jar:6.0.39]
        at
org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109)
[catalina.jar:6.0.39]
        at
org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:293)
[catalina.jar:6.0.39]
        at
org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:861)
[tomcat-coyote.jar:6.0.39]
        at
org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:606)
[tomcat-coyote.jar:6.0.39]
        at
org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:489)
[tomcat-coyote.jar:6.0.39]
        at java.lang.Thread.run(Thread.java:745) [na:1.7.0_55]
Caused by: sun.security.validator.ValidatorException: PKIX path building
failed: sun.security.provider.certpath.SunCertPathBuilderException: unable
to find valid certification path to requested target
        at
sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:385)
~[na:1.7.0_55]
        at
sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:292)
~[na:1.7.0_55]
        at sun.security.validator.Validator.validate(Validator.java:260)
~[na:1.7.0_55]
        at
sun.security.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:326)
~[na:1.7.0_55]
        at
sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:231)
~[na:1.7.0_55]
        at
sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:126)
~[na:1.7.0_55]
        at
sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1323)
~[na:1.7.0_55]
        ... 31 common frames omitted
Caused by: sun.security.provider.certpath.SunCertPathBuilderException:
unable to find valid certification path to requested target
        at
sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:196)
~[na:1.7.0_55]
        at
java.security.cert.CertPathBuilder.build(CertPathBuilder.java:268)
~[na:1.7.0_55]
        at
sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:380)
~[na:1.7.0_55]
        ... 37 common frames omitted


Any suggestions on how to fix this?

Thanks,
Mike
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20150801/cf3ed6df/attachment.html>

More information about the users mailing list