<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><br class=""><div><blockquote type="cite" class=""><div class="">On Aug 1, 2015, at 10:29 AM, Michael Dahlberg <<a href="mailto:olgamirth@gmail.com" class="">olgamirth@gmail.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div dir="ltr" class="">We're running Shib IdP v.2.4.0, java 1.7.0.55 and tomcat 6.0.39 with the CAS client libraries v. 3.2.1 (yes, I know some are a bit dated). We're using CAS as the backend authentication mechanism installed as detailed in <a href="https://wiki.jasig.org/display/CASUM/Shibboleth-CAS+Integration" class="">https://wiki.jasig.org/display/CASUM/Shibboleth-CAS+Integration</a><div class=""><br class=""></div><div class="">This morning we updated the SSL certificate on the CAS server and immediately Shib logins cease to function (if we move back to the old cert, logins work). We were using RapidSSL as our CA, now we're using InCommon.</div><div class=""><br class=""></div><div class="">I've tried replacing /usr/java/latest/jre/lib/security/cacerts with a cacerts file from java 1.8</div></div></div></blockquote><div><br class=""></div>You'll need to add the needed intermediate cert(s) that the InCommon issuing cert has between it and the root CA cert (AddTrust External CA Root) to the cacerts file. Probably want to do this on your CAS Server, so that it serves out the full chain needed for your CAS clients (like the Shib IdP server with embedded CAS client libraries) to be able to verify who they are talking to for the ticket interaction. The InCommon cert site documents what those intermediate certs are, and these often won't be in the distributed cacerts that come with Java. If you aren't sure how to do that, then you can follow the info in something like:</div><div><br class=""></div><div> <a href="https://www.sslshopper.com/tomcat-ssl-installation-instructions.html" class="">https://www.sslshopper.com/tomcat-ssl-installation-instructions.html</a> or Comodo's:</div><div> <a href="https://support.comodo.com/index.php?/Default/Knowledgebase/Article/View/638/37/certificate-installation-java-based-web-servers-tomcat-using-keytool" class="">https://support.comodo.com/index.php?/Default/Knowledgebase/Article/View/638/37/certificate-installation-java-based-web-servers-tomcat-using-keytool</a> </div><div><br class=""></div><div>or any number of StackOverFlow entries. From InCommon:</div><div><br class=""></div><div> <a href="https://spaces.internet2.edu/display/InCCollaborate/InCommon+Cert+Types" class="">https://spaces.internet2.edu/display/InCCollaborate/InCommon+Cert+Types</a></div><div><br class=""></div><div>From that document:</div><div><h3 id="InCommonCertTypes-SSL/TLSCertificates" style="margin: 30px 0px 0px; padding: 0px; font-size: 21px; line-height: 1.5625; font-family: Arial, sans-serif;" class="">SSL/TLS Certificates</h3><h4 id="InCommonCertTypes-SHA-2ServerCertificates" style="margin: 10px 0px 0px; padding: 0px; line-height: 20px; font-family: Arial, sans-serif;" class="">SHA-2 Server Certificates</h4><p style="margin: 10px 0px 0px; padding: 0px; color: rgb(51, 51, 51); font-size: 13px; font-family: Arial, sans-serif; line-height: 18px;" class="">The intermediate CA known as the InCommon RSA Server CA, which uses the SHA-2 hash algorithm, was deployed on September 22, 2014.</p><ul style="margin: 10px 0px 0px; font-size: 13px; color: rgb(51, 51, 51); font-family: Arial, sans-serif; line-height: 18px;" class=""><li class=""><em class="">Certificate Chain:</em><ul style="margin: 0px 0px 4px; list-style-type: disc;" class=""><li class="">AddTrust External CA Root</li><li class="">USERTrust RSA Certification Authority [<a href="http://crt.usertrust.com/USERTrustRSAAddTrustCA.crt" class="external-link" style="color: rgb(50, 108, 166); text-decoration: none;">DER</a>]</li><li class="">InCommon RSA Server CA [<a href="http://crt.incommon-rsa.org/InCommonRSAServerCA_2.crt" class="external-link" style="color: rgb(50, 108, 166); text-decoration: none;">DER</a>]</li><li class="">End-Entity Certificate</li></ul></li></ul><div class=""><br class=""></div></div><div><br class=""></div><div apple-content-edited="true" class=""><br class="">--<br class="">Michael A. Grady<br class="">IAM Architect, Unicon, Inc.
</div>
<br class=""></body></html>