Hi,<br><br>the problem was, that when enabled clientAuth, the Client (Browser) needs a PKAS Certificate.<br>So I created one from the idp.jks file with openssl, added it to firefox certificates and now it works.<br>I'm wondering why SSLCertificateFile and SSLCertificateKeyFile don't have a effect on the redirecting procedure.<br>
I can use a self created one or even sp-cert.pem and sp-key.pem from the service provider. <br><br><br>Stephan<br><br><div class="gmail_quote">2012/6/17 Chad La Joie <span dir="ltr"><<a href="mailto:lajoie@itumi.biz" target="_blank">lajoie@itumi.biz</a>></span><br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">I don't know what to tell you. The connector configuration you gave<br>
is listening on port 8433, the URL you are showing is not hitting that<br>
port so you either have something between the browser and the server<br>
changing the port that is being accessed or the URL or the config you<br>
gave is not what you're using.<br>
<div class="im HOEnZb"><br>
On Sun, Jun 17, 2012 at 1:04 PM, Stephan Hackstedt<br>
<<a href="mailto:stephan.hackstedt@googlemail.com">stephan.hackstedt@googlemail.com</a>> wrote:<br>
> I could solve a part of the problem, and know I can access the<br>
><br>
> <a href="https://sp.machine.com:553/Shibboleth.sso/Metadata" target="_blank">https://sp.machine.com:553/Shibboleth.sso/Metadata</a> (SP runs under port 553,<br>
> cause both SP and IdP are running on the same machine)<br>
> and<br>
> <a href="https://idp.machine.com/idp/profile/Status" target="_blank">https://idp.machine.com/idp/profile/Status</a><br>
><br>
> Nevertheless, when setting clientAuth="true" in tomcats server.xml I always<br>
> got the follwing error when trying to access a protecetd ressource.<br>
><br>
> ssl_error_bad_cert_alert<br>
<br>
</div><div class="HOEnZb"><div class="h5">--<br>
Chad La Joie<br>
<a href="http://www.itumi.biz" target="_blank">www.itumi.biz</a><br>
trusted identities, delivered<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
</div></div></blockquote></div><br>