ldaps connection failure

[cbaker]

I'm trying to switch from RemoteUser authn to Password authn, and using ldap
to do the password authentication.  When using remoteUser I've been pulling
attributes from the same ldap tree already using all the same configurations
and credentials.  But when I try to connect to the same ldap tree for authn
I get the error:

 unable to connect to the ldap
org.ldaptive.provider.ConnectionException:
javax.net.ssl.SSLHandshakeException:
sun.security.validator.ValidatorException: PKIX path building failed:
sun.security.provider.certpath.SunCertPathBuilderException: unable to find
valid certification path to requested target


I'm using jvmTrust and I've downloaded and installed the appropriate cert
into the trustStore at JAVA_HOME/jre/lib/security/cacerts using the
instructions found here: https://github.com/escline/InstallCert

and verified that it is in that store by using the keytool -list command
/usr/java/jdk1.8.0_92/jre/bin/keytool -list -keystore
/usr/java/jdk1.8.0_92/jre/lib/security/cacerts

My ldap.properties are

idp.authn.LDAP.authenticator                   = bindSearchAuthenticator
idp.authn.LDAP.ldapURL                         =
ldaps://ldap.example.com:636
idp.authn.LDAP.useStartTLS                     = true
idp.authn.LDAP.useSSL                          = false
idp.authn.LDAP.connectTimeout                  = 3000
idp.authn.LDAP.sslConfig                       = jvmTrust

I'm fairly confident that the correct cert is in the correct keystore
because I can run


# java InstallCert ldap.example.com:636
Loading KeyStore /usr/java/jdk1.8.0_92/jre/lib/security/cacerts...
Opening connection to ldap.example.com:636...
Starting SSL handshake...

No errors, certificate is already trusted


So what am I doing wrong here?




--
View this message in context: http://shibboleth.1660669.n2.nabble.com/ldaps-connection-failure-tp7625919.html
Sent from the Shibboleth - Users mailing list archive at Nabble.com.