<div dir="ltr"><div>David,</div><div><br></div><div>I can't speak to exactly what went wrong(copy paste issues, random whitespace, actually broken certificate), but apparently parsing is failing although the overall approach of putting both certificates in the metadata should be fine.  I would guess the certificate data that you put in the element itself is broken.  You might use openssl x509's toolkit as a sanity check.</div><div><br></div><div>Hope this helps,</div><div>Nate.</div><div><br></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Fri, Sep 28, 2018 at 4:37 PM, IAM David Bantz <span dir="ltr"><<a href="mailto:dabantz@alaska.edu" target="_blank">dabantz@alaska.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">SP provided new cert (they provide self-signed certs in metadata with 1 year lifetime).<div><br></div><div>I added the new cert to my copy of the SP metadata, anticipating a transition period where either cert could be used, but that triggers this error in processing an incoming request: </div><div><br></div><div>





<p class="m_-3933712414510498703gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:11px;line-height:normal;font-family:Menlo;color:rgb(0,0,0)"><span class="m_-3933712414510498703gmail-s1" style="font-variant-ligatures:no-common-ligatures">ERROR [137.229.160.20] org.springframework.webflow.<wbr>execution.<wbr>ActionExecutionException:76 > <span class="m_-3933712414510498703gmail-Apple-converted-space"> </span></span></p>
<p class="m_-3933712414510498703gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:11px;line-height:normal;font-family:Menlo;color:rgb(0,0,0)"><span class="m_-3933712414510498703gmail-s1" style="font-variant-ligatures:no-common-ligatures">org.springframework.webflow.<wbr>execution.<wbr>ActionExecutionException: Exception thrown executing net.shibboleth.idp.profile.<wbr>impl.<wbr>WebFlowMessageHandlerAdaptor@<wbr>71d0fe07 in state 'SAML2SSOSecurityPolicy' of flow 'intercept/security-policy/<wbr>saml2-sso' -- action execution attributes were 'map[[empty]]'</span></p>
<p class="m_-3933712414510498703gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:11px;line-height:normal;font-family:Menlo;color:rgb(0,0,0)"><span class="m_-3933712414510498703gmail-s1" style="font-variant-ligatures:no-common-ligatures"><span class="m_-3933712414510498703gmail-Apple-converted-space">        </span>at org.springframework.webflow.<wbr>execution.ActionExecutor.<wbr>execute(ActionExecutor.java:<wbr>60)</span></p>
<p class="m_-3933712414510498703gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:11px;line-height:normal;font-family:Menlo;color:rgb(0,0,0)"><span class="m_-3933712414510498703gmail-s1" style="font-variant-ligatures:no-common-ligatures">Caused by: org.cryptacular.<wbr>StreamException: IO error</span></p>
<p class="m_-3933712414510498703gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:11px;line-height:normal;font-family:Menlo;color:rgb(0,0,0)"><span class="m_-3933712414510498703gmail-s1" style="font-variant-ligatures:no-common-ligatures"><span class="m_-3933712414510498703gmail-Apple-converted-space">        </span>at org.cryptacular.util.CertUtil.<wbr>readCertificate(CertUtil.java:<wbr>256)</span></p>
<p class="m_-3933712414510498703gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:11px;line-height:normal;font-family:Menlo;color:rgb(0,0,0)"><span class="m_-3933712414510498703gmail-s1" style="font-variant-ligatures:no-common-ligatures">Caused by: java.io.IOException: Incomplete BER/DER data</span></p>
<p class="m_-3933712414510498703gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:11px;line-height:normal;font-family:Menlo;color:rgb(0,0,0)"><span class="m_-3933712414510498703gmail-s1" style="font-variant-ligatures:no-common-ligatures"><span class="m_-3933712414510498703gmail-Apple-converted-space">        </span>at sun.security.provider.<wbr>X509Factory.readBERInternal(<wbr>X509Factory.java:751)</span></p><p class="m_-3933712414510498703gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:11px;line-height:normal;font-family:Menlo;color:rgb(0,0,0)"><span class="m_-3933712414510498703gmail-s1" style="font-variant-ligatures:no-common-ligatures"><br></span></p><p class="m_-3933712414510498703gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:11px;line-height:normal;font-family:Menlo;color:rgb(0,0,0)"><span class="m_-3933712414510498703gmail-s1" style="font-variant-ligatures:no-common-ligatures">Is the strategy flawed or did I do something else dumb?</span></p><p class="m_-3933712414510498703gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:11px;line-height:normal;font-family:Menlo;color:rgb(0,0,0)"><span class="m_-3933712414510498703gmail-s1" style="font-variant-ligatures:no-common-ligatures"><br>David Bantz</span></p><p class="m_-3933712414510498703gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:11px;line-height:normal;font-family:Menlo;color:rgb(0,0,0)"><span class="m_-3933712414510498703gmail-s1" style="font-variant-ligatures:no-common-ligatures">UA OIT IAM</span></p></div></div>
<br>-- <br>
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg" rel="noreferrer" target="_blank">https://wiki.shibboleth.net/<wbr>confluence/x/coFAAg</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.<wbr>net</a><br></blockquote></div><br></div>