idp3: Path does not chain with any of the trust anchors

[Cantor, Scott]

On 11/11/15, 4:20 AM, "users on behalf of TISSOT Jacques" <users-bounces at shibboleth.net on behalf of jacques.tissot at unifr.ch> wrote:



>But basically, I don't understand the difference between certificateTrust and keystoreTrust:
>
>"certificateTrust: Uses the idp.authn.LDAP.trustCertificates property to load a resource containing the trust anchors (such as a file of PEM-format certificates)"
>"keyStoreTrust : Uses the idp.authn.LDAP.trustStore property to load a keystore containing the trust anchors"

One relies on the Java keystore abstraction (limiting it to JKS and PKCS12 files) and the other works on any resource that can supply the much simpler/common PEM format, typically a text file.

>Q (which): which certificate should I use against the ldap servers: Root_CA, Sub_CA, Sub_CA chained ? And should I store also the server-side certificates issued to the ldap servers?

Java allows any certificate in a path to be a trust anchor so you can do whatever you want.

>Q (where): where do I store the(se) certificate(s) ? In the /opt/shibboleth-idp/credentials/ directory as pem files or imported in the /opt/shibboleth-idp/credentials/cacerts keystore?

You can store them whereever you want.


There is no "cacerts" keystore. If you mean the global Java one, that should never be used.

-- Scott