PKIX path building failed

[Brent Putman]

On 10/29/16 7:44 AM, Cantor, Scott wrote:
> My guess is that maybe Windows' PKIX code might follow AIA extensions, but I would be surprised if anything else did. OpenSSL definitely does not, and unless I'm deeply mistaken, Java doesn't. 

Oracle Java can do it optionally.  I remembered that they have a system
property you can set to turn it on, but IIRC in some previous versions
it only supported LDAP URLs, which is both a little odd and also not
very useful for most people.  But looks like in 7 at least, they support
HTTP:

http://docs.oracle.com/javase/7/docs/technotes/guides/security/certpath/CertPathProgGuide.html#AIA

> We would be pretty concerned about that sort of thing because once you start going HTTP GET operations, you introduce almost guaranteed concerns over timeout settings.

Agreed.  AFAIK it's off by default, so hopefully that lessens the
concern.  I'm sure they probably use one of the standard internal Java
HTTP client mechanisms, and off-hand I don't know what kind of timeouts
those have.

Since it has to be turned on explicitly, though, I doubt that this is
relevant to troubleshooting the OP's issue.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20161029/390e881b/attachment.html>