SAML1

[Rod Widdowson]

> I am with IDP3 on Tomcat 8, behind on HTTPD (connect with AJP) and behind
> one another HTTPD.

If you are behind HTTPD you need to be configuring that to not be policing
the incoming TLS 

I do *not* speak  HTTPD (since that way of operation is not something we
primarily support these days) , I assume you do.  I *think* something like

SSLVerifyClient optional_no_ca
SSLVerifyDepth 10

Is what you need for the 8443 port