<div dir="ltr"><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">Did you try several <security:Certificate> elements or having more<br>
than once certificate in the file (in both possible orders)?</blockquote><div><br></div><div>Looks like I need one file with all of the certs in the chain (the cert for the LDAP server, intermediary CA, and the top level root CA).<br>
<br>Liam</div></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Mon, Mar 24, 2014 at 12:43 PM, Cantor, Scott <span dir="ltr"><<a href="mailto:cantor.2@osu.edu" target="_blank">cantor.2@osu.edu</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="">On 3/24/14, 12:39 PM, "Peter Schober" <<a href="mailto:peter.schober@univie.ac.at">peter.schober@univie.ac.at</a>> wrote:<br>
><br>
>Whether there's a way to use <StartTLSTrustCredential> to configure a<br>
>certificate chain for use inside a DataConnector I don't know.<br>
<br>
</div>I don't either, but as a general matter, make sure the LDAP server is<br>
doing things correctly and returning at least all but the final root CA.<br>
It should only be necessary to include the CA in the local trust store.<br>
<span class="HOEnZb"><font color="#888888"><br>
-- Scott<br>
</font></span><div class="HOEnZb"><div class="h5"><br>
<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
</div></div></blockquote></div><br></div>