<div dir="ltr">We're running Shib IdP v.2.4.0, java 1.7.0.55 and tomcat 6.0.39 with the CAS client libraries v. 3.2.1 (yes, I know some are a bit dated). We're using CAS as the backend authentication mechanism installed as detailed in <a href="https://wiki.jasig.org/display/CASUM/Shibboleth-CAS+Integration">https://wiki.jasig.org/display/CASUM/Shibboleth-CAS+Integration</a><div><br></div><div>This morning we updated the SSL certificate on the CAS server and immediately Shib logins cease to function (if we move back to the old cert, logins work).  We were using RapidSSL as our CA, now we're using InCommon.</div><div><br></div><div>I've tried replacing /usr/java/latest/jre/lib/security/cacerts with a cacerts file from java 1.8</div><div><br></div><div>The error messages that we get in the IdP idp-process.log file are as follows:</div><div><br></div><div><div>08:29:32.933 - ERROR [org.jasig.cas.client.util.CommonUtils:340] - sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target</div><div>javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target</div><div>        at sun.security.ssl.Alerts.getSSLException(Alerts.java:192) ~[na:1.7.0_55]</div><div>        at sun.security.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1884) ~[na:1.7.0_55]</div><div>        at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:276) ~[na:1.7.0_55]</div><div>        at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:270) ~[na:1.7.0_55]</div><div>        at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1341) ~[na:1.7.0_55]</div><div>        at sun.security.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:153) ~[na:1.7.0_55]</div><div>        at sun.security.ssl.Handshaker.processLoop(Handshaker.java:868) ~[na:1.7.0_55]</div><div>        at sun.security.ssl.Handshaker.process_record(Handshaker.java:804) ~[na:1.7.0_55]</div><div>        at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:1016) ~[na:1.7.0_55]</div><div>        at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1312) ~[na:1.7.0_55]</div><div>        at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1339) ~[na:1.7.0_55]</div><div>        at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1323) ~[na:1.7.0_55]</div><div>        at sun.net.www.protocol.https.HttpsClient.afterConnect(HttpsClient.java:563) ~[na:1.7.0_55]</div><div>        at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(AbstractDelegateHttpsURLConnection.java:185) ~[na:1.7.0_55] </div><div>        at sun.net.www.protocol.http.HttpURLConnection.getInputStream(HttpURLConnection.java:1300) ~[na:1.7.0_55]</div><div>        at sun.net.www.protocol.https.HttpsURLConnectionImpl.getInputStream(HttpsURLConnectionImpl.java:254) ~[na:1.7.0_55]</div><div>        at org.jasig.cas.client.util.CommonUtils.getResponseFromServer(CommonUtils.java:326) [cas-client-core-3.2.1.jar:3.2.1]</div><div>        at org.jasig.cas.client.util.CommonUtils.getResponseFromServer(CommonUtils.java:305) [cas-client-core-3.2.1.jar:3.2.1]</div><div>        at org.jasig.cas.client.validation.AbstractCasProtocolUrlBasedTicketValidator.retrieveResponseFromServer(AbstractCasProtocolUrlBasedTicketValidator.java:50) [cas-client-core-3.2.1.jar:3.2.1]</div><div>        at org.jasig.cas.client.validation.AbstractUrlBasedTicketValidator.validate(AbstractUrlBasedTicketValidator.java:207) [cas-client-core-3.2.1.jar:3.2.1]</div><div>        at org.jasig.cas.client.validation.AbstractTicketValidationFilter.doFilter(AbstractTicketValidationFilter.java:169) [cas-client-core-3.2.1.jar:3.2.1]</div><div>        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235) [catalina.jar:6.0.39]</div><div>        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [catalina.jar:6.0.39]</div><div>        at org.jasig.cas.client.authentication.AuthenticationFilter.doFilter(AuthenticationFilter.java:116) [cas-client-core-3.2.1.jar:3.2.1]</div><div>        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235) [catalina.jar:6.0.39]    </div><div>        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [catalina.jar:6.0.39]</div><div>        at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:219) [catalina.jar:6.0.39]</div><div>        at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:191) [catalina.jar:6.0.39]</div><div>        at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:127) [catalina.jar:6.0.39]</div><div>        at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:103) [catalina.jar:6.0.39]</div><div>        at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109) [catalina.jar:6.0.39]</div><div>        at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:293) [catalina.jar:6.0.39]</div><div>        at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:861) [tomcat-coyote.jar:6.0.39]</div><div>        at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:606) [tomcat-coyote.jar:6.0.39]</div><div>        at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:489) [tomcat-coyote.jar:6.0.39]</div><div>        at java.lang.Thread.run(Thread.java:745) [na:1.7.0_55]</div><div>Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target</div><div>        at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:385) ~[na:1.7.0_55]</div><div>        at sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:292) ~[na:1.7.0_55]</div><div>        at sun.security.validator.Validator.validate(Validator.java:260) ~[na:1.7.0_55]</div><div>        at sun.security.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:326) ~[na:1.7.0_55]</div><div>        at sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:231) ~[na:1.7.0_55]</div><div>        at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:126) ~[na:1.7.0_55]</div><div>        at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1323) ~[na:1.7.0_55]</div><div>        ... 31 common frames omitted</div><div>Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target</div><div>        at sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:196) ~[na:1.7.0_55]</div><div>        at java.security.cert.CertPathBuilder.build(CertPathBuilder.java:268) ~[na:1.7.0_55]</div><div>        at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:380) ~[na:1.7.0_55]</div><div>        ... 37 common frames omitted</div></div><div><br></div><div><br></div><div>Any suggestions on how to fix this?</div><div><br></div><div>Thanks,</div><div>Mike</div></div>