LDAP connection failure to SHA-2 InCommon cert

[Cantor, Scott]

On 3/25/16, 4:53 PM, "users on behalf of Dave Bartholomew" <users-bounces at shibboleth.net on behalf of Dave.Bartholomew at csueastbay.edu> wrote:



>Despite Java being “OK” is there an IdP limitation as to when a SHA-2 signed cert on an LDAP server used for attribute retrieval is workable?

No.

Basic trust issue, the CA chain involved with those certs is complicated, and keeping old clients working with those new certs requires additional intermediates be installed on the server end, or you need to put the appropriate CA into the trust store you're using on the client.

The real bug here is on the LDAP server, it's not including the right intermediates on its end to keep it all working until clients are updated with the SHA-2 CA.

-- Scott