PKIX path building failed

[Cantor, Scott]

> If I'm sniffing the network after an IdP restart and things are working
> normally, should I expect to see an HTTP GET for
> crt.usertrust.com/USERTrustRSAAddTrustCA.crt
>  to complete the chain via the AIA? It looks like Shib suddenly lost its ability to use the AIA.

No. No version of Shibboleth ever, nor any other software by and large, would ever go fetching an intermediate certificate from a web site (and it wouldn't know where to get it, I don't know what that URL is from, but if it's some certificate extension, no, that's not supported). You either have it, or the server sends it, or it fails.

> What I don't get:
> 
> The persistent failure.

The same server configuration and the same client configuration should only give different results if a CRL is involved. There's no other variable information. When Java just breaks randomly, it means there was a Java update. Usually when this sort of thing happens, the reason is that the server was updated and nobody told anybody about it. In recent years, it's usually the SHA-1 to SHA-2 transition that breaks things.

> I can't seem to catch Shibboleth or ldp.exe in the act of grabbing the AIA.

Nothing does that that I've ever heard of, outside of PKIX lab experiments. No real code does. If OpenSSL works, then it's using different trust anchors.

-- Scott