<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 14 (filtered medium)"><base href="x-msg://6615/"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:Verdana;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Balloon Text Char";
margin:0cm;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma","sans-serif";}
span.BalloonTextChar
{mso-style-name:"Balloon Text Char";
mso-style-priority:99;
mso-style-link:"Balloon Text";
font-family:"Tahoma","sans-serif";}
span.apple-style-span
{mso-style-name:apple-style-span;}
span.EmailStyle20
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:#1F497D;}
span.EmailStyle21
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-GB link=blue vlink=purple><div class=WordSection1><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>I re-exported the certificate and gave it a password this time and I successfully put it into the keystore!<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Yusuf<o:p></o:p></span></p><div><div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm'><p class=MsoNormal><b><span lang=EN-US style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span></b><span lang=EN-US style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'> users-bounces@shibboleth.net [mailto:users-bounces@shibboleth.net] <b>On Behalf Of </b>Yusuf Tran<br><b>Sent:</b> 09 June 2013 19:03<br><b>To:</b> Shib Users<br><b>Subject:</b> RE: IDP config for load balanced AD servers with SSL (LDAPS)<o:p></o:p></span></p></div></div><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal style='line-height:150%'><span style='font-size:11.0pt;line-height:150%;font-family:"Calibri","sans-serif";color:#1F497D'>Hi Nate,<o:p></o:p></span></p><p class=MsoNormal style='line-height:150%'><span style='font-size:11.0pt;line-height:150%;font-family:"Calibri","sans-serif";color:#1F497D'>Regarding adding the certificate to the keystore, I’ve tried the following but I keep getting an error about srcstorepass even though the certificate has no password set:<o:p></o:p></span></p><p class=MsoNormal style='line-height:150%'><span style='font-size:11.0pt;line-height:150%;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal style='line-height:150%'><span style='font-size:11.0pt;line-height:150%;font-family:"Calibri","sans-serif";color:#1F497D'>keytool -importkeystore -srckeystore kicds.com.pfx -srcstoretype PKCS12 -destkeystore /opt/shibboleth-idp/credentials/idp.jks -deststoretype JKS -deststorepass xxxx<o:p></o:p></span></p><p class=MsoNormal style='line-height:150%'><span style='font-size:11.0pt;line-height:150%;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal style='line-height:150%'><span style='font-size:11.0pt;line-height:150%;font-family:"Calibri","sans-serif";color:#1F497D'>also tried –destkeystore /usr/java/jdk1.7.0_21/jre/lib/security/cacerts<o:p></o:p></span></p><p class=MsoNormal style='line-height:150%'><span style='font-size:11.0pt;line-height:150%;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal style='line-height:150%'><span style='font-size:11.0pt;line-height:150%;font-family:"Calibri","sans-serif";color:#1F497D'>I add the keystore password for idk.jks as the same password when first installing the IDP.<o:p></o:p></span></p><p class=MsoNormal style='line-height:150%'><span style='font-size:11.0pt;line-height:150%;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal style='line-height:150%'><span style='font-size:11.0pt;line-height:150%;font-family:"Calibri","sans-serif";color:#1F497D'>But I get the following error:<o:p></o:p></span></p><p class=MsoNormal style='line-height:150%'><span style='font-size:11.0pt;line-height:150%;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal style='line-height:150%'><span style='font-size:11.0pt;line-height:150%;font-family:"Calibri","sans-serif";color:#1F497D'>***************** WARNING WARNING WARNING *****************<o:p></o:p></span></p><p class=MsoNormal style='line-height:150%'><span style='font-size:11.0pt;line-height:150%;font-family:"Calibri","sans-serif";color:#1F497D'>* The integrity of the information stored in the srckeystore*<o:p></o:p></span></p><p class=MsoNormal style='line-height:150%'><span style='font-size:11.0pt;line-height:150%;font-family:"Calibri","sans-serif";color:#1F497D'>* has NOT been verified! In order to verify its integrity, *<o:p></o:p></span></p><p class=MsoNormal style='line-height:150%'><span style='font-size:11.0pt;line-height:150%;font-family:"Calibri","sans-serif";color:#1F497D'>* you must provide the srckeystore password. *<o:p></o:p></span></p><p class=MsoNormal style='line-height:150%'><span style='font-size:11.0pt;line-height:150%;font-family:"Calibri","sans-serif";color:#1F497D'>***************** WARNING WARNING WARNING *****************<o:p></o:p></span></p><p class=MsoNormal style='line-height:150%'><span style='font-size:11.0pt;line-height:150%;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal style='line-height:150%'><span style='font-size:11.0pt;line-height:150%;font-family:"Calibri","sans-serif";color:#1F497D'>keytool error: java.security.UnrecoverableKeyException: Get Key failed: null<o:p></o:p></span></p><p class=MsoNormal style='line-height:150%'><span style='font-size:11.0pt;line-height:150%;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal style='line-height:150%'><span style='font-size:11.0pt;line-height:150%;font-family:"Calibri","sans-serif";color:#1F497D'>Any ideas?<o:p></o:p></span></p><p class=MsoNormal style='line-height:150%'><span style='font-size:11.0pt;line-height:150%;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal style='line-height:150%'><span style='font-size:11.0pt;line-height:150%;font-family:"Calibri","sans-serif";color:#1F497D'>Yusuf</span><i><span style='font-size:8.0pt;line-height:150%;font-family:"Verdana","sans-serif";color:#7F7F7F'><o:p></o:p></span></i></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><div><div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm'><p class=MsoNormal><b><span lang=EN-US style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span></b><span lang=EN-US style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'> <a href="mailto:users-bounces@shibboleth.net">users-bounces@shibboleth.net</a> [<a href="mailto:users-bounces@shibboleth.net">mailto:users-bounces@shibboleth.net</a>] <b>On Behalf Of </b>Nate Klingenstein<br><b>Sent:</b> 08 June 2013 03:18<br><b>To:</b> Shib Users<br><b>Subject:</b> Re: IDP config for load balanced AD servers with SSL (LDAPS)<o:p></o:p></span></p></div></div><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Yusuf, <o:p></o:p></p><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>This isn't really a Shibboleth question, but answers below.<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><div><blockquote style='margin-top:5.0pt;margin-bottom:5.0pt'><div><div><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif"'>Could you advise on the best strategy for creating and implementing the certificate(s)? I've seen guides to do this for one server but not 2 load balanced servers.<o:p></o:p></span></p></div></div></blockquote><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>You can give them the same certificate and keypair as long as the hostname they use when communicating with the IdP matches the load balancer, just like you did for the IdPs and SPs.<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>The certificate will need to be trusted by the IdP's. You can do that by adding it directly to the Java truststore, yes.<o:p></o:p></p></div><p class=MsoNormal style='margin-bottom:12.0pt'><o:p> </o:p></p><p class=MsoNormal><span class=apple-style-span><span style='font-size:11.5pt;font-family:"Calibri","sans-serif"'>Will I need to do anything special like create a wildcard cert and try to use the same cert on both DC's?</span></span><o:p></o:p></p><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>No. If they speak to the IdP's using different domain names, a subjectAltName is the most you will need to do.<o:p></o:p></p></div></div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>Thanks,<o:p></o:p></p></div><div><p class=MsoNormal>Nate. <o:p></o:p></p></div></div></body></html>