Backchannel attribute query vs. SSL handshake error

[Misagh Moayyed]

I have configured an instance of idp 3.1.2, running inside jetty v9.2 to
support SAML1 back-channel attribute queries. Here is a summary:

- DTA jar for jetty downloaded and installed
- A shibboleth.mod file put inside the jetty modules directory, that
depends on the SSL module and loads configuration from a
etc/jetty-shibboleth.xml
- The jetty-shibboleth.xml file creates the delegate, as prescribed by the
wiki, sets the path to a backchannel jks file, the password, keystore type
and enables 8443 along with the other changes. 

The Shib SP's etc/hosts file is modified to point to the new idp 3.1.2. SP
logs show that when an attribute query is submitted, this error message is
printed out: "unknown ssl protocol error in connection to..." IDP logs
show no activity of course. This is an IDP initiated flow, with metadata
endpoints configured correctly as much as I can tell. 

Attempts to connect to the idp from the SP via openssl: "openssl s_client
-cert ./sp-cert.pem -key ./sp-key.pem -connect idp.example.org:8443 -debug
-msg -state" reports back SSL handshake errors. Attempts to connect to the
idp from the idp machine itself with the same exact command works
successfully. 

Tried this with two SPs, one running openssl 0.9 and the other openssl
1.0.1. Checked firewalls, port exposure, permissions, and attempted to
pass a CAfile parameter to openssl with a reference to the backchannel
.pem. No differences observed. SPs are running on Linux, though I don't
know what version yet. 

What might be the problem? 

Misagh