<html><head></head><body><div>Hey Scott, Rod,</div><div><br></div><div>This is ultimately for the browser facing port, 443. However I'm using 8443 and then having iptables redirect 443 to 8443. </div><div><br></div><div>I've used openssl as outlined, without keytool involved in the equation. </div><div><br></div><div>The command looked like:</div><div><br></div><div>openssl pkcs12 -export -out itfederation_jmu_edu.p12 -inkey keyfile.key -in intermediatecertandroot.crt -certfile cert.crt</div><div><br></div><div>When I plug this into the Jetty configuration, and make sure the format is set to PKCS12, this is the error I get:</div><div><br></div><div>tail -f 2015_07_14.stderrout.log </div><div>11:07:25,464 |-INFO in ch.qos.logback.classic.joran.action.ConfigurationAction - debug attribute not set</div><div>11:07:25,476 |-INFO in ch.qos.logback.core.joran.action.AppenderAction - About to instantiate appender of type [ch.qos.logback.core.ConsoleAppender]</div><div>11:07:25,483 |-INFO in ch.qos.logback.core.joran.action.AppenderAction - Naming appender as [STDOUT]</div><div>11:07:25,602 |-INFO in ch.qos.logback.classic.joran.action.RootLoggerAction - Setting level of ROOT logger to WARN</div><div>11:07:25,602 |-INFO in ch.qos.logback.core.joran.action.AppenderRefAction - Attaching appender named [STDOUT] to Logger[ROOT]</div><div>11:07:25,602 |-INFO in ch.qos.logback.classic.joran.action.ConfigurationAction - End of configuration.</div><div>11:07:25,603 |-INFO in <a href="mailto:ch.qos.logback.classic.joran.JoranConfigurator@4550bb58">ch.qos.logback.classic.joran.JoranConfigurator@4550bb58</a> - Registering current configuration as safe fallback point</div><div><br></div><div>SLF4J: Actual binding is of type [ch.qos.logback.classic.util.ContextSelectorStaticBinder]</div><div>2015-07-14 11:07:25.606:INFO:/idp:main: Initializing Spring root WebApplicationContext</div><div>2015-07-14 11:07:32.666:INFO:/idp:main: Initializing Spring FrameworkServlet 'idp'</div><div>2015-07-14 11:07:33.701:INFO:oejsh.ContextHandler:main: Started o.e.j.w.WebAppContext@14bf9759{/idp,[file:///opt/shibboleth-idp/jetty-base/tmp/jetty-localhost-8080-webapp-_idp-any-3492213470564608669.dir/webinf/, file:///opt/shibboleth-idp/webapp/],AVAILABLE}{../webapp}</div><div>2015-07-14 11:07:33.729:INFO:oejs.ServerConnector:main: Started <a href="mailto:ServerConnector@7ccfdaef">ServerConnector@7ccfdaef</a>{HTTP/1.1,[http/1.1]}{localhost:8080}</div><div>java.lang.reflect.InvocationTargetException</div><div> at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)</div><div> at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)</div><div> at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)</div><div> at java.lang.reflect.Method.invoke(Method.java:497)</div><div> at org.eclipse.jetty.start.Main.invokeMain(Main.java:214)</div><div> at org.eclipse.jetty.start.Main.start(Main.java:457)</div><div> at org.eclipse.jetty.start.Main.main(Main.java:75)</div><div>Caused by: MultiException[java.io.IOException: Invalid keystore format, java.io.IOException: Invalid keystore format]</div><div> at org.eclipse.jetty.server.Server.doStart(Server.java:347)</div><div> at org.eclipse.jetty.util.component.AbstractLifeCycle.start(AbstractLifeCycle.java:68)</div><div> at org.eclipse.jetty.xml.XmlConfiguration$1.run(XmlConfiguration.java:1520)</div><div> at java.security.AccessController.doPrivileged(Native Method)</div><div> at org.eclipse.jetty.xml.XmlConfiguration.main(XmlConfiguration.java:1445)</div><div> ... 7 more</div><div><br></div><div>Usage: java -jar start.jar [options] [properties] [configs]</div><div> java -jar start.jar --help # for more information</div><div><br style="color: rgb(0, 0, 0); font-family: Tahoma; font-size: 14px;"></div><div><br></div><div><br></div><div>The config snippet looks like this:</div><div><br></div><div>jetty.backchannel.keystore.path=/opt/shibboleth-idp/credentials/idp-backchannel.p12</div><div>jetty.browser.keystore.path=/opt/shibboleth-idp/credentials/itfederation_jmu_edu.p12</div><div><br></div><div># Keystore passwords</div><div>jetty.backchannel.keystore.password=pass</div><div>jetty.browser.keystore.password=pass</div><div><br></div><div># Keystore types</div><div>jetty.backchannel.keystore.type=PKCS12</div><div>jetty.browser.keystore.type=PKCS12</div><div><br></div><div><br></div><div>I'm not understanding what makes it considered invalid.</div><div><br></div><div>Thanks,</div><div><br></div><div><br class="Apple-interchange-newline"><span style="font-family: monospace; white-space: pre;">--
Brandon McKean
IT / Systems
Linux Administrator
(540)568-4235</span></div><div><br></div><div>On Tue, 2015-07-14 at 13:59 +0000, Cantor, Scott wrote:</div><blockquote type="cite"><pre>On 7/14/15, 9:28 AM, "users on behalf of McKean, Brandon Scott - mckeanbs" <<a href="mailto:users-bounces@shibboleth.net">users-bounces@shibboleth.net</a> on behalf of <a href="mailto:mckeanbs@jmu.edu">mckeanbs@jmu.edu</a>> wrote:
<blockquote type="cite">
Accordingly, I have keys, X509 certs, etc for the existing configuration that have worked fine in Apache, but I'm having a difficult time getting them to work with Jetty using the jetty-base that ships with Shibboleth 3.
</blockquote>
As Rod said, that's not right. We provide material on configuring Jetty in the wiki.
<blockquote type="cite">
cat cert.crt intermediate-reverse.crt > cert-chain.txt
openssl pkcs12 -export -inkey example.key -in cert-chain.txt -out example.pkcs12
</blockquote>
I use a command like this with the intermediate in a separate file.
openssl pkcs12 -export -out file.p12 -inkey private.key -in public.crt -certfile chain.crt
<blockquote type="cite">
Then I use keytool like this:
keytool -importkeystore -srckeystore jetty.pkcs12 -srcstoretype PKCS12 -destkeystore keystore
</blockquote>
That will create what you don't want, a keystore.
-- Scott
</pre></blockquote></body></html>