<html><head></head><body><div style="font-family: Verdana;font-size: 12.0px;"><div>Hi,</div>
<div>I have installed my local Shibboleth IdP and configured it for https access.</div>
<div>Now when I try to authenticate on it via sp.testshib.org I successfully login on IdP but when testshib try to execute the attribute query I can see this erorr on testshib <strong>shibd.log</strong></div>
<div> </div>
<div> </div>
<div>
<pre>2017-05-31 09:15:54 DEBUG XMLTooling.TrustEngine.ExplicitKey [1582]: attempting to match credentials from peer with end-entity certificate
2017-05-31 09:15:54 DEBUG XMLTooling.TrustEngine.ExplicitKey [1582]: no keys within this peer's key information matched the given end-entity certificate
2017-05-31 09:15:54 DEBUG XMLTooling.TrustEngine.PKIX [1582]: performing certificate path validation...
2017-05-31 09:15:54 DEBUG XMLTooling.TrustEngine.PKIX [1582]: failed to validate certificate chain using supplied PKIX information
2017-05-31 09:15:54 ERROR XMLTooling.SOAPTransport.CURL [1582]: supplied TrustEngine failed to validate SSL/TLS server certificate
2017-05-31 09:15:54 DEBUG XMLTooling.SOAPTransport.CURL [1582]: Certificate:
Data:
Version: 3 (0x2)
Serial Number:
Signature Algorithm: sha256WithRSAEncryption
Issuer: C=US, O=Let's Encrypt, CN=Let's Encrypt Authority X3
Validity
Not Before: May 23 13:12:00 2017 GMT
Not After : Aug 21 13:12:00 2017 GMT
Subject: CN=xxxx
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
Public-Key: (2048 bit)
Modulus:
Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Key Usage: critical
Digital Signature, Key Encipherment
X509v3 Extended Key Usage:
TLS Web Server Authentication, TLS Web Client Authentication
X509v3 Basic Constraints: critical
CA:FALSE
X509v3 Subject Key Identifier:
X509v3 Authority Key Identifier:
Authority Information Access:
OCSP - URI:http://ocsp.int-x3.letsencrypt.org/
CA Issuers - URI:http://cert.int-x3.letsencrypt.org/
X509v3 Subject Alternative Name:
DNS:xxx
X509v3 Certificate Policies:
Policy: 2.23.140.1.2.1
Policy: 1.3.6.1.4.1.44947.1.1.1
CPS: http://cps.letsencrypt.org
User Notice:
Explicit Text: This Certificate may only be relied upon by Relying Parties and only in accordance with the Certificate Policy found at https://letsencrypt.org/repository/
Signature Algorithm: sha256WithRSAEncryption
2017-05-31 09:15:54 DEBUG XMLTooling.libcurl [1582]: TLSv1.2 (IN), TLS handshake, Server key exchange (12):
2017-05-31 09:15:54 DEBUG XMLTooling.libcurl [1582]: �
2017-05-31 09:15:54 DEBUG XMLTooling.libcurl [1582]: TLSv1.2 (IN), TLS handshake, Request CERT (13):
2017-05-31 09:15:54 DEBUG XMLTooling.libcurl [1582]:
2017-05-31 09:15:54 DEBUG XMLTooling.libcurl [1582]: TLSv1.2 (IN), TLS handshake, Server finished (14):
2017-05-31 09:15:54 DEBUG XMLTooling.libcurl [1582]: TLSv1.2 (OUT), TLS handshake, Certificate (11):
2017-05-31 09:15:54 DEBUG XMLTooling.libcurl [1582]: �
2017-05-31 09:15:54 DEBUG XMLTooling.libcurl [1582]: TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
2017-05-31 09:15:54 DEBUG XMLTooling.libcurl [1582]: TLSv1.2 (OUT), TLS handshake, CERT verify (15):
2017-05-31 09:15:54 DEBUG XMLTooling.libcurl [1582]: TLSv1.2 (OUT), TLS change cipher, Client hello (1):
2017-05-31 09:15:54 DEBUG XMLTooling.libcurl [1582]: TLSv1.2 (OUT), TLS handshake, Finished (20):
2017-05-31 09:15:54 DEBUG XMLTooling.libcurl [1582]: TLSv1.2 (IN), TLS alert, Server hello (2):
2017-05-31 09:15:54 DEBUG XMLTooling.libcurl [1582]: error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca
2017-05-31 09:15:54 DEBUG XMLTooling.libcurl [1582]: Curl_http_done: called premature == 1
2017-05-31 09:15:54 DEBUG XMLTooling.libcurl [1582]: Closing connection 0</pre>
<div> </div>
<div>As you can see the ssl tomcat certificate is a certificate issued by <strong>letsencrypt.org</strong> and it's a valid certificate recognized by every browser. </div>
<div>Can somebody help me with this issue so I can go on and complete my tests?</div>
<div> </div>
<div>Thanks in advance </div>
<div>Cesare</div>
</div></div></body></html>