X509 Certificate-based Authentication in Safari with Shibboleth IdPv4.0.1

[Zunan Dong]

Hi Shib Community,

Recently, we have upgraded one of our IdP server to IdP v4.0.1. The server is deployed with Tomcat 9.0.40 and OpenJDK 11 on CentOS 7.

We find a problem that the X509 certificate-based authentication stops working in Safari. We use a tomcat connector to handle the X509 certificate-based authentication.

Here's the configuration for the tomcat connector.

<Connector port="664"
        protocol="org.apache.coyote.http11.Http11NioProtocol"
        maxThreads="150" SSLEnabled="true" scheme="https" secure="true"
        defaultSSLHostConfigName="idpz.utorauth.utoronto.ca">
      <SSLHostConfig
        hostName="idpz.utorauth.utoronto.ca"
        truststoreFile="/local/etc/shibboleth/credentials/truststore"
        truststorePassword="****"
        truststoreType="JKS"
        certificateVerification="required"
        sslProtocol="TLSv1.2"
        protocols="TLSv1.2">
        <Certificate certificateFile="/etc/pki/tls/links/idpz.utorauth.utoronto.ca/cert"
                     certificateChainFile="/etc/pki/tls/links/idpz.utorauth.utoronto.ca/chain"
                     certificateKeyFile="/etc/pki/tls/links/idpz.utorauth.utoronto.ca/key"/>
      </SSLHostConfig>
    </Connector>

When I connect to this port for certificate-based authentication in Safari. Safari sends ClientHello message with TLSv1 protocol and that causes the SSL handshake with the server to fail. In other browsers, like Chrome, Microsoft Edge, Firefox, there's no such issue, the ClientHello message uses TLSv1.2 protocol and the certificate-based authentication could complete.

Does anyone know if there are any Tomcat/JVM/Shibboleth parameters I need to set up so that Safari can use TLSv1.2 to talk to the server?

Thanks,

Zunan Dong

Authentication Systems Specialist

Information Security

Information Technology Service

University of Toronto

Email: zunan.dong at utoronto.ca

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20210309/c243ca61/attachment.htm>