<div dir="ltr">So I got this to work on my test machine. I installed JRE 1.7, and it still proposed the bad certificate error when trying to connect using openssl s_client -connect ... regardless of protocol specified.<div>
<br></div><div>So I started looking at my Tomcat configuration to see if there was something amiss. I compared my config to the page:</div><div><br></div><div><a href="https://wiki.shibboleth.net/confluence/display/SHIB2/IdPApacheTomcatPrepare">https://wiki.shibboleth.net/confluence/display/SHIB2/IdPApacheTomcatPrepare</a><br>
</div><div><br></div><div>and found that I had set clientAuth = "true" instead of "want". I looked up what that does and apparently it requires a valid cert by supplied before a transaction can be established. I turned this to want and now it works just fine.</div>
<div><br></div><div>To my way of thinking, this means the "alert bad certificate" error isn't saying the cert the server is giving out is bad, but the one it's receiving is bad (or non-existent). I don't know if that's correct, but I do know this new setting is working out and if someone with expertise cares to give a little more explanation on why I would love to hear it.</div>
<div><br></div><div>Otherwise, I can just move forward now. I think this is fixed :)</div><div><br></div><div>p.s. I am running on Solaris 10. Thanks to the guy who suggested the Linux fix, but it wasn't applicable.</div>
</div><div class="gmail_extra"><br><br><div class="gmail_quote">On Mon, Jul 29, 2013 at 3:02 PM, Christopher Peters <span dir="ltr"><<a href="mailto:cjpeters@uci.edu" target="_blank">cjpeters@uci.edu</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Well, we are using it for the SSO transaction (which uses Apache), but I see your point. I don't really know how Java's dependencies are set up, but if you say it's not relying on OSSL, I will take your word for it. That makes life much simpler anyway.<div>
<br></div><div>As for the SSL thing, I have a server mirrored on another system and I can set it up with 1.7 and see if I can get an OpenSSL connection to Tomcat on 8443. I will give that a shot and let you know what I find out.</div>
<div><br></div><div>Chris</div></div><div class="gmail_extra"><div><div class="h5"><br><br><div class="gmail_quote">On Mon, Jul 29, 2013 at 2:50 PM, Cantor, Scott <span dir="ltr"><<a href="mailto:cantor.2@osu.edu" target="_blank">cantor.2@osu.edu</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div>On 7/29/13 5:47 PM, "Christopher Peters" <<a href="mailto:cjpeters@uci.edu" target="_blank">cjpeters@uci.edu</a>> wrote:<br>
<br>
>I will work on upgrading Java to 1.7 and possibly OpenSSL and see if that<br>
>fixes things. We do have a rather old version of OpenSSL on the system,<br>
>and the related libraries. And, of course, an old version of Java.<br>
<br>
</div>You're not using OpenSSL, that's not relevant.<br>
<br>
The bad cert error isn't the expiration, we're talking protocol level<br>
issues here. OpenSSL's s_client doesn't care about the dates or the<br>
validity, it's just trying to negotiate the connection.<br>
<div><div><br>
-- Scott<br>
<br>
<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br>
</div></div></blockquote></div><br><br clear="all"><div><br></div></div></div><div class="im">-- <br><div dir="ltr">
<font face="arial black, sans-serif">Chris Peters</font><br>Middleware Services Developer<br>Office of Information Technology - NSP<br><a href="tel:%28949%29%20824-6845" value="+19498246845" target="_blank">(949) 824-6845</a><br>
<a href="mailto:cjpeters@uci.edu" target="_blank">cjpeters@uci.edu</a><br>
</div>
</div></div>
</blockquote></div><br><br clear="all"><div><br></div>-- <br><div dir="ltr">
<font face="arial black, sans-serif">Chris Peters</font><br>Middleware Services Developer<br>Office of Information Technology - NSP<br>(949) 824-6845<br><a href="mailto:cjpeters@uci.edu" target="_blank">cjpeters@uci.edu</a><br>
</div>
</div>