<div dir="ltr">We are attempting to upgrade our IDP from 2.1.5 to 2.4.0. I have changed all the configuration using the recommendations on this page:<div><br></div><div><a href="https://wiki.shibboleth.net/confluence/display/SHIB2/IdP22Upgrade">https://wiki.shibboleth.net/confluence/display/SHIB2/IdP22Upgrade</a></div>
<div><br></div><div>and for the most part it worked fine, but we had a half dozen service providers who immediately started encountering an SSL error:</div><div><div><br></div><div><span style="font-family:monospace;font-size:13px">CURLSOAPTransport failed while contacting SOAP endpoint (</span><a href="https://shib.nacs.uci.edu:8443/idp/profile/SAML1/SOAP/AttributeQuery" target="_blank" style="font-family:monospace;font-size:13px">https://shib.nacs.uci.edu:8443/idp/profile/SAML1/SOAP/AttributeQuery</a><span style="font-family:monospace;font-size:13px">): error:14094438:SSL routines:SSL3_READ_BYTES:tlsv1 alert internal error</span><br>
</div><div><span style="font-family:monospace;font-size:13px"><br></span></div>I won't go too in detail about our metadata and configuration, as it didn't change (except the minor things listed in the upgrade page), but we use Apache with a connector to Tomcat for attribute queries, and our metadata is published through InCommon for all of these SPs. Also, no software other than the IDP changed. We didn't upgrade SSL, Apache, Tomcat or anything else.<br>
<br>I'm hoping someone has experienced this error and has an idea of what I should be looking at.<br><br>Two further things I want to note: 1) we have two certificates in metadata but only one can be specified in Tomcat configuration at a time, so I am concerned that it fell back to the cert that is not configured.<br>
2) some of the service providers continue to work just fine and retrieve attributes without issue. Is there a version of SP that I might look for in common with this issue?<br><br>Thanks for your help!</div><div><br></div>
<div>-- <br><div dir="ltr">
<font face="arial black, sans-serif">Chris Peters</font><br>Middleware Services Developer<br>Office of Information Technology - NSP<br>(949) 824-6845<br><a href="mailto:cjpeters@uci.edu" target="_blank">cjpeters@uci.edu</a><br>
</div>
</div></div>