<div><br></div><div><div class="gmail_quote"><br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="im">
> I haven't been able to configure it in an way that works? I don't have<br>
>control over the incoming metadata and the inclusion of<br>
>Shibboleth-specific extensions, therefore I am using StaticPKIX.<br>
</div>I don't know whether you're talking about metadata verification or runtime<br>
trust, but those are two different things. The static engine is usually<br>
inappropriate for runtime trust, it's too rigid for most deployments.<br>
There are no Shibboleth extensions relevant to metadata verification, so<br>
you're apparently mixing models.<br></blockquote>When I spoke of metadata, I meant the metadata extensions identified in the TrustEngine documentation, which would be used at runtime for SAML Request signature validation. </div>
<div class="gmail_quote"><br></div><div class="gmail_quote">Unfortunately, I seem to be stuck in a catch-22 based on the current implementation for CRL validation though. The certificates we are forced to deal with use a DirName CRL Distribution Point, which identifies a DN where that particular certificate's CRL can be downloaded (can be different for each certificate). Since neither OpenSSL, nor Shibboleth support this extension, I have a process in place to periodically download the CRL and place it in a local file. In processing the StaticPKIX TrustEngine with this local CRL path and checkRevocation set to "entityOnly" or "fullChain", I get the following error in the logs:</div>
<div class="gmail_quote"> OpenSSL [3]: path validation failure: unhandled critical CRL extension</div><div class="gmail_quote"><br></div><div class="gmail_quote">I am assuming it refers to the DirName CRL extension ie </div>
<div class="gmail_quote"> X509v3 CRL Distribution Points:</div><div class="gmail_quote"> DirName:</div><div class="gmail_quote"><br></div><div class="gmail_quote">Short of a customization to the xml-tooling call to OpenSSL's verify_cert call to ignore missing "critical extensions", it seems I am out of luck on implementing CRL validation with this type of cert?</div>
<div class="gmail_quote"><br></div><div class="gmail_quote">Marc</div><div class="gmail_quote"><br></div><div class="gmail_quote"><br class="Apple-interchange-newline"><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<span class="HOEnZb"><font color="#888888"><br>
-- Scott<br>
<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
</font></span></blockquote></div><br></div>