<p>Unfortunately it is not an option for me.<br>
Is that a limitation of the product? Push comes to shove I could use the java keystore but I'd rather keep it in a separate keystore if possible.</p>
<div class="gmail_quote">On Oct 15, 2013 9:24 PM, "Daniel Fisher" <<a href="mailto:dfisher@vt.edu">dfisher@vt.edu</a>> wrote:<br type="attribution"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div dir="ltr">On Tue, Oct 15, 2013 at 8:42 AM, Byte Flinger <span dir="ltr"><<a href="mailto:byteflinger@gmail.com" target="_blank">byteflinger@gmail.com</a>></span> wrote:<br><div class="gmail_extra"><div class="gmail_quote">
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div dir="ltr">Hi<div><br></div><div>I have read the Shibboleth IDP wiki page on how to configure ldap ssl using java's own keystore and my tests worked fine that way using ldaps however I would like to use my own separate keystore somewhere else in the disk.</div>
<div><br></div><div>I tried using the "sslSocketFactory" on login.config to point to a JKS but that gives me some IO errors, also pointing to just the crt of the CA did not seem to work (Got certificate path errors even though I tried both with the client certificate and the CA certificate immediately under it). </div>
<div><br></div><div>Is it possible to use a separate keystore for both login and also for the attribute connector?</div><div><br></div><div>I should mention that this is on IDP 2.4 and that I am not using StartTLS, it is a straight ssl connection to the ldap server.</div>
</div>
</blockquote></div><br></div><div class="gmail_extra">This is much easier if you use StartTLS, is that an option?</div><div class="gmail_extra"><br></div><div class="gmail_extra">--Daniel Fisher</div><div class="gmail_extra">
<br></div></div>
<br>--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br></blockquote></div>