<div dir="ltr"><div>Howdy all I have and idp 2.x server that has stopped working ...Let me give a little background then I'll give the error.</div><div><br></div><div><br></div><div>Our shib server is setup to authenticate against  our cas server (<a href="http://sso.pima.edu">sso.pima.edu</a>) .. today the SSL cert for our cas servers expired .. we have updated that now and the cas servers themselves appear to be working .... after the new SSL cert for our cas servers was updated ... our shib server would then get an error after authentication via (cas) ... So my first thought was OH I need to update the cacerts file on the shib server with the new SSL for our cas server ... here the error I see in the idp-process.log</div><div><br></div><div>11:14:37.042 - ERROR [org.jasig.cas.client.util.CommonUtils:406] - Remote host closed connection during handshake<br>javax.net.ssl.SSLHandshakeException: Remote host closed connection during handshake<br>        at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:941) ~[na:1.6.0_41]<br>        at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1320) ~[na:1.6.0_41]<br>        at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1347) ~[na:1.6.0_41]<br>        at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1331) ~[na:1.6.0_41]<br>        at sun.net.www.protocol.https.HttpsClient.afterConnect(HttpsClient.java:432) ~[na:1.6.0_41]<br>        at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(AbstractDelegateHttpsURLConnection.java:185) ~[na:1.6.0_41]<br>        at sun.net.www.protocol.http.HttpURLConnection.getInputStream(HttpURLConnection.java:1278) ~[na:1.6.0_41]<br>        at sun.net.www.protocol.https.HttpsURLConnectionImpl.getInputStream(HttpsURLConnectionImpl.java:254) ~[na:1.6.0_41]<br>        at org.jasig.cas.client.util.CommonUtils.getResponseFromServer(CommonUtils.java:393) ~[cas-client-core-3.3.3.jar:3.3.3]<br>        at org.jasig.cas.client.validation.AbstractCasProtocolUrlBasedTicketValidator.retrieveResponseFromServer(AbstractCasProtocolUrlBasedTicketValidator.java:45) ~[cas-client-core-3.3.3.jar:3.3.3]<br>        at org.jasig.cas.client.validation.AbstractUrlBasedTicketValidator.validate(AbstractUrlBasedTicketValidator.java:200) ~[cas-client-core-3.3.3.jar:3.3.3]<br>        at org.jasig.cas.client.validation.AbstractTicketValidationFilter.doFilter(AbstractTicketValidationFilter.java:206) ~[cas-client-core-3.3.3.jar:3.3.3]<br>        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235) ~[catalina-6.0.24.jar:na]<br>        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) ~[catalina-6.0.24.jar:na]<br>        at org.jasig.cas.client.authentication.AuthenticationFilter.doFilter(AuthenticationFilter.java:161) ~[cas-client-core-3.3.3.jar:3.3.3]<br>        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235) ~[catalina-6.0.24.jar:na]<br>        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) ~[catalina-6.0.24.jar:na]<br>        at edu.internet2.middleware.shibboleth.idp.util.NoCacheFilter.doFilter(NoCacheFilter.java:50) ~[shibboleth-identityprovider-2.4.0.jar:na]<br>        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235) ~[catalina-6.0.24.jar:na]<br>        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) ~[catalina-6.0.24.jar:na]<br>        at edu.internet2.middleware.shibboleth.idp.session.IdPSessionFilter.doFilter(IdPSessionFilter.java:87) ~[shibboleth-identityprovider-2.4.0.jar:na]<br>        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235) ~[catalina-6.0.24.jar:na]<br>        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) ~[catalina-6.0.24.jar:na]<br>        at edu.internet2.middleware.shibboleth.common.log.SLF4JMDCCleanupFilter.doFilter(SLF4JMDCCleanupFilter.java:52) ~[shibboleth-common-1.4.0.jar:na]<br>        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235) ~[catalina-6.0.24.jar:na]<br>        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) ~[catalina-6.0.24.jar:na]<br>        at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:219) ~[catalina-6.0.24.jar:na]<br>        at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:191) ~[catalina-6.0.24.jar:na]<br>        at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:127) ~[catalina-6.0.24.jar:na]<br>        at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102) ~[catalina-6.0.24.jar:na]<br>        at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109) ~[catalina-6.0.24.jar:na]<br>        at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:299) ~[catalina-6.0.24.jar:na]<br>        at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:857) ~[tomcat-coyote-6.0.24.jar:na]<br>        at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:588) ~[tomcat-coyote-6.0.24.jar:na]<br>        at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:489) ~[tomcat-coyote-6.0.24.jar:na]<br>        at java.lang.Thread.run(Thread.java:701) ~[na:1.6.0_41]<br>Caused by: java.io.EOFException: SSL peer shut down incorrectly<br></div><div><br></div><div>updating the cacerts file did not take care of the error ... (that is unless it's using a different one ..which i'm checking on now) ....</div><div><br></div><div>any help appreciated as we are down for any shibboleth authentication based apps</div><div><br></div><div>Thanks!</div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><br clear="all"><div><div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div><div></div><div><br></div><div>Brad Mathis</div><div>IT Principal Systems Analyst</div><div>Infrastructure Services - Applications<br></div><div>Pima Community College<br></div><div>520.206.4826<br></div><div><a href="mailto:bmathis@pima.edu" target="_blank">bmathis@pima.edu</a></div></div><div><br></div><div><img src="https://docs.google.com/a/pima.edu/uc?id=0B4QEFWYNTFJATTZySzROc0JISEk&export=download" width="200" height="150"><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div>