Error retrieving metadata: SSLPeerUnverifiedException

[Brent Putman]

On 6/18/15 6:34 PM, Brent Putman wrote:
>
> So there's a fairly standard PKIX path validation error going on
> here.  In my experience however this usually results in an IOException
> being thrown in JSSE.  From what I can tell of the JSSE debug output,
> however, it's not doing that here for some reason. It seems instead to
> just be closing the socket and returning. Or maybe we're somehow
> swallowing it that I'm not seeing.  Then our hostname verification
> code runs unconditionally (expecting that an exception would have been
> thrown if the socket wasn't ok), producing the spurious error above,
> because the SSLSession is already closed/invalid. 
>
> So we likely might have a bug here in our socket factory, but perhaps
> not the same one as I originally thought. Indeed a more trivial one.

I opened the issue below for this.  Really this is just the case of a
misleading error message being emitted.  I have applied a fix in svn.

For the archives: Just noting that if you see:

javax.net.ssl.SSLPeerUnverifiedException: SSL peer failed hostname
validation for name: null

it really means that the SSL handshake has failed, such as due to cert
validation error, or possibly something else like no acceptable cipher
suites, etc.  The actual exception in this case is being swallowed and
handled internally.

Setting javax.net.debug=all will provide all the gory details of what
failed.

https://issues.shibboleth.net/jira/browse/JOWS-44
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20150618/3e5b0136/attachment.html>