<div dir="ltr"><div dir="ltr"><div class="gmail_default" style="font-family:garamond,serif;display:inline">Dear Shibboleth Users and Developers, <br><br></div>I was wondering if anyone has seen this behaviour<div class="gmail_default" style="font-family:garamond,serif;display:inline"> or some suggestions on getting this to work. <br></div><br><div class="gmail_default" style="font-family:garamond,serif"><br></div><div class="gmail_default" style="font-family:garamond,serif">I have an IDP server and have four Apache web servers running the SP software, three work fine and one does not work with the exact same metadata file with the exact same certificate.<br><br></div><div class="gmail_default" style="font-family:garamond,serif">On the Apache SP that does not work I get the following message: <br><br>2014-11-07 16:21:04 DEBUG XMLTooling.SOAPTransport.CURL [1]: invoking custom X.509 verify callback<br>2014-11-07 16:21:04 DEBUG XMLTooling.TrustEngine.ExplicitKey [1]: attempting to match credentials from peer with end-entity certificate<br>2014-11-07 16:21:04 DEBUG XMLTooling.TrustEngine.ExplicitKey [1]: no keys within this peer's key information matched the given end-entity certificate<br>2014-11-07 16:21:04 DEBUG XMLTooling.TrustEngine.PKIX [1]: performing certificate path validation...<br>2014-11-07 16:21:04 DEBUG XMLTooling.TrustEngine.PKIX [1]: failed to validate certificate chain using supplied PKIX information<br>2014-11-07 16:21:04 ERROR XMLTooling.SOAPTransport.CURL [1]: supplied TrustEngine failed to validate SSL/TLS server certificate<br>2014-11-07 16:21:04 ERROR XMLTooling.SOAPTransport.CURL [1]: Certificate:<br><br></div><div class="gmail_default" style="font-family:garamond,serif"><Cert Deleted><br><br>2014-11-07 16:21:04 DEBUG XMLTooling.libcurl [1]: SSLv3, TLS alert, Server hello (2):<br>2014-11-07 16:21:04 DEBUG XMLTooling.libcurl [1]: SSL certificate problem: application verification failure<br>2014-11-07 16:21:04 DEBUG XMLTooling.libcurl [1]: Closing connection 0<br><br></div><div class="gmail_default" style="font-family:garamond,serif"><br></div><div class="gmail_default" style="font-family:garamond,serif">The three Apache SP servers that work have the following configuration: <br><br></div><div class="gmail_default" style="font-family:garamond,serif">OS: Red Hat Enterprise Linux 6.5<br></div><div class="gmail_default" style="font-family:garamond,serif">Apache: httpd-2.2.15-31<br></div><div class="gmail_default" style="font-family:garamond,serif">Shibboleth SP: shibboleth-2.5.3-1.1<br><br></div><div class="gmail_default" style="font-family:garamond,serif">The Apache SP server that does not work: <br></div><div class="gmail_default" style="font-family:garamond,serif"><br></div><div class="gmail_default" style="font-family:garamond,serif">OS: Red Hat Enterprise Linux 7.0<br></div><div class="gmail_default" style="font-family:garamond,serif">Apache: httpd-2.4.6-18<br></div><div class="gmail_default" style="font-family:garamond,serif">Shibboleth SP: shibboleth-2.5.3-2.1<br><br></div><div class="gmail_default" style="font-family:garamond,serif">IDP Server<br></div><div class="gmail_default" style="font-family:garamond,serif">OS: Red Hat Enterprise Linux 6.5<br></div><div class="gmail_default" style="font-family:garamond,serif">Shibboleth IDP: 2.4.0<br></div><div class="gmail_default" style="font-family:garamond,serif"><br></div><div class="gmail_default" style="font-family:garamond,serif">So why is is that the IDP metadata with the same certificate works on one config but not the other? And yes it's the same, <br>because I copied the same IDP metadata file from one working machine to the machine that does not work. <br><br>I can supply additional information as needed. <br><br></div><div class="gmail_default" style="font-family:garamond,serif">Would this be an issue because the version of the IDP server is a bit old? I see the latest release is: 2.4.3. (2014/11/03) and the version <br>is well over a year old. <br></div><div class="gmail_default" style="font-family:garamond,serif"><br></div><div class="gmail_default" style="font-family:garamond,serif">Thanks for your help in advanced! <br><br></div><div class="gmail_default" style="font-family:garamond,serif">Regards, <br>Chris<br><br></div><div class="gmail_default" style="font-family:garamond,serif"><br></div></div>
</div>