<div dir="ltr"><div>All,</div><div><br></div><div>I was just trying to use <a href="http://testshib.org">testshib.org</a> to test an OpenAM SP setup and one thing I ran into is that some of the endpoint URLs in the testshib-providers.xml metadata file are referencing endpoints that have a self-signed SSL certificate for some reason.  The problematic URLs are all referencing port 8443 instead of the standard 443 port for SSL.<br></div><div><br></div><div>From the metadata:</div><div><br></div><div>...</div><div><div>            <ArtifactResolutionService Binding="urn:oasis:names:tc:SAML:1.0:bindings:SOAP-binding"</div><div>                Location="<a href="https://idp.testshib.org:8443/idp/profile/SAML1/SOAP/ArtifactResolution">https://idp.testshib.org:8443/idp/profile/SAML1/SOAP/ArtifactResolution</a>"</div><div>                index="1"/></div><div>            <ArtifactResolutionService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP"</div><div>                Location="<a href="https://idp.testshib.org:8443/idp/profile/SAML2/SOAP/ArtifactResolution">https://idp.testshib.org:8443/idp/profile/SAML2/SOAP/ArtifactResolution</a>"</div><div>                index="2"/></div></div><div>...</div><div><div>            <AttributeService Binding="urn:oasis:names:tc:SAML:1.0:bindings:SOAP-binding"</div><div>                Location="<a href="https://idp.testshib.org:8443/idp/profile/SAML1/SOAP/AttributeQuery">https://idp.testshib.org:8443/idp/profile/SAML1/SOAP/AttributeQuery</a>"/></div><div>            <AttributeService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP"</div><div>                Location="<a href="https://idp.testshib.org:8443/idp/profile/SAML2/SOAP/AttributeQuery">https://idp.testshib.org:8443/idp/profile/SAML2/SOAP/AttributeQuery</a>"/></div></div><div>...</div><div><br></div><div>The issue here (for OpenAM at least) is that <a href="http://idp.testshib.org:8443">idp.testshib.org:8443</a> returns an untrusted, self-signed certificate instead of the trusted certificate which is used on <a href="http://idp.testshib.org:443">idp.testshib.org:443</a>.  I'm not sure if these URLs are incorrect and should be edited to use port 443 instead of 8443 or whether the ports are correct but the service listening on :8443 is just incorrectly configured to use the wrong certificate.</div><div><br></div><div>Thanks!</div><div>Corey</div></div>