Yikes it's busted idp 2.x

[Mathis, Bradley]

Howdy all I have and idp 2.x server that has stopped working ...Let me give
a little background then I'll give the error.


Our shib server is setup to authenticate against  our cas server (
sso.pima.edu) .. today the SSL cert for our cas servers expired .. we have
updated that now and the cas servers themselves appear to be working ....
after the new SSL cert for our cas servers was updated ... our shib server
would then get an error after authentication via (cas) ... So my first
thought was OH I need to update the cacerts file on the shib server with
the new SSL for our cas server ... here the error I see in the
idp-process.log

11:14:37.042 - ERROR [org.jasig.cas.client.util.CommonUtils:406] - Remote
host closed connection during handshake
javax.net.ssl.SSLHandshakeException: Remote host closed connection during
handshake
        at
sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:941)
~[na:1.6.0_41]
        at
sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1320)
~[na:1.6.0_41]
        at
sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1347)
~[na:1.6.0_41]
        at
sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1331)
~[na:1.6.0_41]
        at
sun.net.www.protocol.https.HttpsClient.afterConnect(HttpsClient.java:432)
~[na:1.6.0_41]
        at
sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(AbstractDelegateHttpsURLConnection.java:185)
~[na:1.6.0_41]
        at
sun.net.www.protocol.http.HttpURLConnection.getInputStream(HttpURLConnection.java:1278)
~[na:1.6.0_41]
        at
sun.net.www.protocol.https.HttpsURLConnectionImpl.getInputStream(HttpsURLConnectionImpl.java:254)
~[na:1.6.0_41]
        at
org.jasig.cas.client.util.CommonUtils.getResponseFromServer(CommonUtils.java:393)
~[cas-client-core-3.3.3.jar:3.3.3]
        at
org.jasig.cas.client.validation.AbstractCasProtocolUrlBasedTicketValidator.retrieveResponseFromServer(AbstractCasProtocolUrlBasedTicketValidator.java:45)
~[cas-client-core-3.3.3.jar:3.3.3]
        at
org.jasig.cas.client.validation.AbstractUrlBasedTicketValidator.validate(AbstractUrlBasedTicketValidator.java:200)
~[cas-client-core-3.3.3.jar:3.3.3]
        at
org.jasig.cas.client.validation.AbstractTicketValidationFilter.doFilter(AbstractTicketValidationFilter.java:206)
~[cas-client-core-3.3.3.jar:3.3.3]
        at
org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
~[catalina-6.0.24.jar:na]
        at
org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
~[catalina-6.0.24.jar:na]
        at
org.jasig.cas.client.authentication.AuthenticationFilter.doFilter(AuthenticationFilter.java:161)
~[cas-client-core-3.3.3.jar:3.3.3]
        at
org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
~[catalina-6.0.24.jar:na]
        at
org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
~[catalina-6.0.24.jar:na]
        at
edu.internet2.middleware.shibboleth.idp.util.NoCacheFilter.doFilter(NoCacheFilter.java:50)
~[shibboleth-identityprovider-2.4.0.jar:na]
        at
org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
~[catalina-6.0.24.jar:na]
        at
org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
~[catalina-6.0.24.jar:na]
        at
edu.internet2.middleware.shibboleth.idp.session.IdPSessionFilter.doFilter(IdPSessionFilter.java:87)
~[shibboleth-identityprovider-2.4.0.jar:na]
        at
org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
~[catalina-6.0.24.jar:na]
        at
org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
~[catalina-6.0.24.jar:na]
        at
edu.internet2.middleware.shibboleth.common.log.SLF4JMDCCleanupFilter.doFilter(SLF4JMDCCleanupFilter.java:52)
~[shibboleth-common-1.4.0.jar:na]
        at
org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
~[catalina-6.0.24.jar:na]
        at
org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
~[catalina-6.0.24.jar:na]
        at
org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:219)
~[catalina-6.0.24.jar:na]
        at
org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:191)
~[catalina-6.0.24.jar:na]
        at
org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:127)
~[catalina-6.0.24.jar:na]
        at
org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102)
~[catalina-6.0.24.jar:na]
        at
org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109)
~[catalina-6.0.24.jar:na]
        at
org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:299)
~[catalina-6.0.24.jar:na]
        at
org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:857)
~[tomcat-coyote-6.0.24.jar:na]
        at
org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:588)
~[tomcat-coyote-6.0.24.jar:na]
        at
org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:489)
~[tomcat-coyote-6.0.24.jar:na]
        at java.lang.Thread.run(Thread.java:701) ~[na:1.6.0_41]
Caused by: java.io.EOFException: SSL peer shut down incorrectly

updating the cacerts file did not take care of the error ... (that is
unless it's using a different one ..which i'm checking on now) ....

any help appreciated as we are down for any shibboleth authentication based
apps

Thanks!








Brad Mathis
IT Principal Systems Analyst
Infrastructure Services - Applications
Pima Community College
520.206.4826
bmathis at pima.edu
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20190607/2e3af4ba/attachment.html>