Yikes it's busted idp 2.x

[Mathis, Bradley]

Thanks Peter,    I did finally track it down,  it was indeed SSL ciphers.
We use our LB for SSL offloading ..  the new SSL certificate configuration
didn't have all the Ciphers that were used in the previous config ... once
we added the needed cipher we were back in business.  Thanks for your
response.

Brad Mathis
IT Principal Systems Analyst
Infrastructure Services - Applications
Pima Community College
520.206.4826
bmathis at pima.edu









On Fri, Jun 7, 2019 at 2:14 PM Peter Schober <peter.schober at univie.ac.at>
wrote:

> * Mathis, Bradley <bmathis at pima.edu> [2019-06-07 20:58]:
> > So my first thought was OH I need to update the cacerts file on the
> > shib server with the new SSL for our cas server ...
>
> FYI, I'd expect a "cacert" file to contain certificates of CAs,
> i.e. Certification Authorities. So unless the new CAS server uses a
> new and different (private?) Certificate Authority to sign the CAS
> server certificate messing with "cacerts" wouldn't fix anything.
>   I know nothing about CAS but all an SSL client needs is a set of
> trust anchors (CA cert files) and an SSL server that serves up a
> complete certificate chain rooted in one of the trust anchors.
>   Imagine every web browser would need to perform some kind of update
> each time a web server changed its SSL certificate...
>
> > here the error I see in the idp-process.log
> >
> > 11:14:37.042 - ERROR [org.jasig.cas.client.util.CommonUtils:406] - Remote
> > host closed connection during handshake
> > javax.net.ssl.SSLHandshakeException: Remote host closed connection
> during handshake
> [...]
> > Caused by: java.io.EOFException: SSL peer shut down incorrectly
>
> I'd start with the server logs from the server that does TLS/SSL for
> CAS and maybe increase the log levels there. Failing that you can
> try to do the same on the SSL client side (i.e. the IDP).
>
> Maybe the IDP's JVM tries to use ciphers the CAS server doesn't accept
> anymore or something like that. You said IDPv2 so the whole OS and VM
> is likely many, many years old.
>
> -peter
> --
> For Consortium Member technical support, see
> https://wiki.shibboleth.net/confluence/x/coFAAg
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20190607/da379fdb/attachment.html>