<div dir="ltr">Hey Scott et al,<div><br></div><div>I just wanted to give an update on this as I've finally resolved it and I figured people would want to know. </div><div><br></div><div>As I understand it, weak encryption methods are the culprit here. Apparently, when you use Tomcat 6.0.x (or 5.5, I honestly don't know if this applies to 7), the JSSE connector on port 8443 (instead of the APR connector) and you don't specify which "ciphers" to use, the java implementation of SSL will fail. I don't know if it's a security limitation or a misuse of some cipher, but in any case I followed the directions here:</div>
<div><br></div><div><a href="http://blog.techstacks.com/2008/09/securing-ssl-in-tomcat-part-two.html">http://blog.techstacks.com/2008/09/securing-ssl-in-tomcat-part-two.html</a><br></div><div><br></div><div>And specified a list of ciphers to use, and that cleared the problem up. I might yet switch to the APR connector now that I know where the problem lies and the APR connector is purported to be the better configuration to use, but in the meantime I have a working system. </div>
<div><br></div><div>Thanks to everyone for your help, and if you have any further comments on this resolution I'd love to hear them.</div><div><br></div><div>Chris </div></div><div class="gmail_extra"><br><br><div class="gmail_quote">
On Tue, Jul 30, 2013 at 9:58 AM, Cantor, Scott <span dir="ltr"><<a href="mailto:cantor.2@osu.edu" target="_blank">cantor.2@osu.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div class="im">On 7/30/13 12:31 PM, "Christopher Peters" <<a href="mailto:cjpeters@uci.edu">cjpeters@uci.edu</a>> wrote:<br>
<br>
>and found that I had set clientAuth = "true" instead of "want". I looked<br>
>up what that does and apparently it requires a valid cert by supplied<br>
>before a transaction can be established. I turned this to want and now<br>
>it works just fine.<br>
<br>
</div>Ah, good point. Didn't think of that.<br>
<div class="im"><br>
>To my way of thinking, this means the "alert bad certificate" error isn't<br>
>saying the cert the server is giving out is bad, but the one it's<br>
>receiving is bad (or non-existent). I don't know if that's correct, but<br>
>I do know this new setting is working out and if someone with expertise<br>
>cares to give a little more explanation on why I would love to hear it.<br>
<br>
</div>I think you're correct.<br>
<div class="im"><br>
>Otherwise, I can just move forward now. I think this is fixed :)<br>
<br>
</div>I don't think that's causing your other problems, just explains what we<br>
saw.<br>
<div class="HOEnZb"><div class="h5"><br>
-- Scott<br>
<br>
<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
</div></div></blockquote></div><br><br clear="all"><div><br></div>-- <br><div dir="ltr">
<font face="arial black, sans-serif">Chris Peters</font><br>Middleware Services Developer<br>Office of Information Technology - NSP<br>(949) 824-6845<br><a href="mailto:cjpeters@uci.edu" target="_blank">cjpeters@uci.edu</a><br>
</div>
</div>