Bad server certificate trying to get to the top-level https://shibboleth.net from AWS or a zscaler address

[Paul Wilt]

zscaler is a VPN-like utility that strongly verifies that the SSL certificates match the domain which is being protected.

Thus, it reports "Access denied due to bad server certificate".  When I turn off that protection it allows me in.

====

I think that the curl error (expired certificate) may be one of the mirrorlist servers.  I don't know how to communicate that to the maintainers of the mirrorlist.
________________________________
From: Cantor, Scott <cantor.2 at osu.edu>
Sent: Thursday, February 24, 2022 5:56 PM
To: Shib Users <users at shibboleth.net>
Cc: Paul Wilt <Paul.Wilt at Clarivate.com>
Subject: Re: Bad server certificate trying to get to the top-level https://shibboleth.net from AWS or a zscaler address

>    14: curl#60 - "SSL certificate problem: certificate has expired"

The chain we're serving up is fine so far as I know (and I just checked it with openssl, the exact set we're returning are all unexpired). You can verify that for yourself.

>    Or when running with zscaler we get the following error:

The root of the vhost redirects to https://urldefense.com/v3/__http://www.shibboleth.net__;!!NknhfzgzgQ!nnGxDK7P4pPBoCTV_uP6_F6Wcfa-Rv-xRa-qHziH4cne5QpjqCaPTA-b_NBEdoO7i-w$ , there are only specific content directories on the server that don't. I have no idea what zscaler is but it's irrelevant.

-- Scott



Confidentiality note: This e-mail may contain confidential information from Clarivate. If you are not the intended recipient, be aware that any disclosure, copying, distribution or use of the contents of this e-mail is strictly prohibited. If you have received this e-mail in error, please delete this e-mail and notify the sender immediately.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20220225/61b3a71f/attachment.htm>