https metadata fetch weirdness after windows SP 3.5.0 update

[Paul B. Henson]

I've got a client that is having trouble fetching metadata from an idp 
after updating to sp 3.5.0.2; they were previously running 3.4.1.2:

2025-03-25 20:47:09 ERROR XMLTooling.ParserPool : fatal error on line 0,
column 0, message: unable to read from socket for URL 'https://
idp.uvic.ca/idp/shibboleth'
2025-03-25 20:47:09 ERROR OpenSAML.MetadataProvider.XML : error while
loading resource (https://idp.uvic.ca/idp/shibboleth): XML error(s)
during parsing, check log for specifics

I asked them to test it under the versions in between, and confirmed it
broke as of 3.5.0, which says it updated to the latest versions of
libcurl/openssl for the Windows packages (looks like openssl 3.3.2 and 
libcurl 8.10.1, from openssl 3.0.9 and libcurl 8.4.0).

I tried to replicate this on a linux dev SP which was running 3.4.1-1
and interestingly it also failed, plus curl gave an error trying to
download by hand:

# curl https://idp.uvic.ca/idp/shibboleth
<?xml version="1.0" encoding="UTF-8"?>
<md:EntityDescriptor entityID="https://idp.uvic.ca/idp/shibboleth"
[...]
     </SPSSODescriptor>
curl: (56) OpenSSL SSL_read: error:0A000126:SSL routines::unexpected eof
while reading, errno 0

This was a Rocky 9 server that hadn't been used or updated for a while,
I pulled all the latest packages including sp 3.5.0-2 which updated 
openssl from 3.0.7-27.el9.0.2 to 3.2.2-6.el9_5.1 and libcurl from
7.76.1-29.el9_4 to 7.76.1-31.el9. Afterwards, it worked fine, both
downloading by the SP and by hand with curl.

So my data points are that openssl 3.0.7 under linux didn't work,
openssl 3.2.2 does, whereas 3.0.9 under windows was working, but now
3.3.2 isn't 8-/.

I'd like to try passing in SSL_OP_IGNORE_UNEXPECTED_EOF on the new
version to see what happens, but unfortunately the openssl
TransportOption only supports SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION
(any reason this one wasn't implemented to pass in arbitrary options
like the curl TransportOption?).

Where does the version of openssl bundled with the SP look for 
openssl.cnf? The only thing I found in the build scripts was "set 
OPENSSL_DIR=openssl-3.3.2" and I think that is where the build script 
looks for the sources, not where the resulting openssl libraries look 
for the config file. Theoretically I should be able to set the 
SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION option in the config file if I 
can figure out where to put it.

Any other thoughts on what might be failing? Anybody else running into 
random metadata download URLs that started failing as of 3.5.0?

Thanks…