Yikes it's busted idp 2.x

[Peter Schober]

* Mathis, Bradley <bmathis at pima.edu> [2019-06-07 20:58]:
> So my first thought was OH I need to update the cacerts file on the
> shib server with the new SSL for our cas server ...

FYI, I'd expect a "cacert" file to contain certificates of CAs,
i.e. Certification Authorities. So unless the new CAS server uses a
new and different (private?) Certificate Authority to sign the CAS
server certificate messing with "cacerts" wouldn't fix anything.
  I know nothing about CAS but all an SSL client needs is a set of
trust anchors (CA cert files) and an SSL server that serves up a
complete certificate chain rooted in one of the trust anchors.
  Imagine every web browser would need to perform some kind of update
each time a web server changed its SSL certificate...

> here the error I see in the idp-process.log
> 
> 11:14:37.042 - ERROR [org.jasig.cas.client.util.CommonUtils:406] - Remote
> host closed connection during handshake
> javax.net.ssl.SSLHandshakeException: Remote host closed connection during handshake
[...]
> Caused by: java.io.EOFException: SSL peer shut down incorrectly

I'd start with the server logs from the server that does TLS/SSL for
CAS and maybe increase the log levels there. Failing that you can
try to do the same on the SSL client side (i.e. the IDP).

Maybe the IDP's JVM tries to use ciphers the CAS server doesn't accept
anymore or something like that. You said IDPv2 so the whole OS and VM
is likely many, many years old.

-peter