<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Helvetica;
panose-1:0 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:12.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
p.p1, li.p1, div.p1
{mso-style-name:p1;
margin:0in;
font-size:9.0pt;
font-family:Helvetica;
color:#7F0055;}
p.p2, li.p2, div.p2
{mso-style-name:p2;
margin:0in;
font-size:9.0pt;
font-family:Helvetica;
color:#2A00FF;}
p.p3, li.p3, div.p3
{mso-style-name:p3;
margin:0in;
font-size:9.0pt;
font-family:Helvetica;}
p.p4, li.p4, div.p4
{mso-style-name:p4;
margin:0in;
font-size:9.0pt;
font-family:Helvetica;}
p.p5, li.p5, div.p5
{mso-style-name:p5;
margin:0in;
font-size:9.0pt;
font-family:Helvetica;
color:#3F7F5F;}
span.s1
{mso-style-name:s1;
color:black;}
span.s2
{mso-style-name:s2;
color:#2A00FF;}
span.s3
{mso-style-name:s3;
color:#7F0055;}
span.apple-converted-space
{mso-style-name:apple-converted-space;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:12.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt">Hi,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">I am using tier/shib-idp:4.1.4_20210802 and I am getting the following error:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";color:black">Bad Request<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";color:black">This combination of host and port requires TLS.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">I generated a new keystore using the command here:
<a href="https://tomcat.apache.org/tomcat-9.0-doc/ssl-howto.html">https://tomcat.apache.org/tomcat-9.0-doc/ssl-howto.html</a><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">keytool -genkey -keyalg RSA -alias tomcat -keystore keystore.jks<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Here is my tomcat/conf/server.xml:<o:p></o:p></span></p>
<p class="p1"><span class="s1"><?</span><b>xml</b><span class="s1"> </span><b>version</b><span class="s1">=</span><span class="s2">'1.0'</span><span class="s1">
</span><b>encoding</b><span class="s1">=</span><span class="s2">'utf-8'</span><span class="s1">?></span><o:p></o:p></p>
<p class="p2"><span class="s1"><<b>Server</b> </span><span class="s3"><b>port</b></span><span class="s1">=</span>"8005"<span class="s1">
</span><span class="s3"><b>shutdown</b></span><span class="s1">=</span>"SHUTDOWN"<span class="s1">></span><o:p></o:p></p>
<p class="p2"><span class="apple-converted-space"><span style="color:black"> </span>
</span><span class="s1"><<b>Listener</b> </span><span class="s3"><b>className</b></span><span class="s1">=</span>"org.apache.catalina.core.AprLifecycleListener"<span class="s1">
</span><span class="s3"><b>SSLEngine</b></span><span class="s1">=</span>"on"<span class="s1"> /></span><o:p></o:p></p>
<p class="p2"><span class="apple-converted-space"><span style="color:black"> </span>
</span><span class="s1"><<b>Listener</b> </span><span class="s3"><b>className</b></span><span class="s1">=</span>"org.apache.catalina.core.JreMemoryLeakPreventionListener"<span class="s1"> /></span><o:p></o:p></p>
<p class="p3"><o:p> </o:p></p>
<p class="p4"><span class="apple-converted-space"> </span><<b>Service</b> <span class="s3">
<b>name</b></span>=<span class="s2">"Catalina"</span>><o:p></o:p></p>
<p class="p3"><o:p> </o:p></p>
<p class="p5"><span class="apple-converted-space"><span style="color:black"> </span>
</span><!-- <Connector protocol="org.apache.coyote.http11.Http11NioProtocol"<o:p></o:p></p>
<p class="p5"><span class="apple-converted-space"> </span>port="443" maxThreads="200" scheme="https"<o:p></o:p></p>
<p class="p5"><span class="apple-converted-space"> </span>secure="true" SSLEnabled="true"<o:p></o:p></p>
<p class="p5"><span class="apple-converted-space"> </span>keystoreFile="/opt/certs/keystore.jks"<o:p></o:p></p>
<p class="p5"><span class="apple-converted-space"> </span>keystorePass="xxxxxxx"<o:p></o:p></p>
<p class="p5"><span class="apple-converted-space"> </span>clientAuth="false" sslProtocol="TLS"<o:p></o:p></p>
<p class="p5"><span class="apple-converted-space"> </span>URIEncoding="UTF-8"<o:p></o:p></p>
<p class="p5"><span class="apple-converted-space"> </span>compression="force"<o:p></o:p></p>
<p class="p5"><span class="apple-converted-space"> </span>compressableMimeType="text/html,text/xml,text/plain,text/javascript,text/css"/> --><o:p></o:p></p>
<p class="p3"><o:p> </o:p></p>
<p class="p4"><span class="apple-converted-space"> </span><<b>Connector</b><o:p></o:p></p>
<p class="p2"><span class="apple-converted-space"><span style="color:black">
</span></span><span class="s3"><b>protocol</b></span><span class="s1">=</span>"org.apache.coyote.http11.Http11NioProtocol"<o:p></o:p></p>
<p class="p1"><span class="apple-converted-space"><span style="color:black">
</span></span><b>port</b><span class="s1">=</span><span class="s2">"443"</span><span class="s1">
</span><b>maxThreads</b><span class="s1">=</span><span class="s2">"200"</span><o:p></o:p></p>
<p class="p1"><span class="apple-converted-space"><span style="color:black">
</span></span><b>scheme</b><span class="s1">=</span><span class="s2">"https"</span><span class="s1">
</span><b>secure</b><span class="s1">=</span><span class="s2">"true"</span><span class="s1">
</span><b>SSLEnabled</b><span class="s1">=</span><span class="s2">"true"</span><span class="s1">></span><o:p></o:p></p>
<p class="p4"><span class="apple-converted-space"> </span><<b>SSLHostConfig</b><o:p></o:p></p>
<p class="p2"><span class="apple-converted-space"><span style="color:black">
</span></span><span class="s3"><b>ciphers</b></span><span class="s1">=</span>"ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384"<o:p></o:p></p>
<p class="p1"><span class="apple-converted-space"><span style="color:black">
</span></span><b>disableSessionTickets</b><span class="s1">=</span><span class="s2">"true"</span><o:p></o:p></p>
<p class="p1"><span class="apple-converted-space"><span style="color:black">
</span></span><b>honorCipherOrder</b><span class="s1">=</span><span class="s2">"false"</span><o:p></o:p></p>
<p class="p2"><span class="apple-converted-space"><span style="color:black">
</span></span><span class="s3"><b>protocols</b></span><span class="s1">=</span>"TLSv1.2,TLSv1.3"<span class="s1">></span><o:p></o:p></p>
<p class="p4"><span class="apple-converted-space"> </span><<b>Certificate</b><o:p></o:p></p>
<p class="p2"><span class="apple-converted-space"><span style="color:black">
</span></span><span class="s3"><b>certificateKeystoreFile</b></span><span class="s1">=</span>"/opt/certs/keystore.jks"<span class="apple-converted-space"><span style="color:black"> </span></span><o:p></o:p></p>
<p class="p2"><span class="apple-converted-space"><span style="color:black">
</span></span><span class="s3"><b>certificateKeystorePassword</b></span><span class="s1">=</span>"xxxxxxx"<span class="s1"> /></span><o:p></o:p></p>
<p class="p4"><span class="apple-converted-space"> </span></<b>SSLHostConfig</b>><o:p></o:p></p>
<p class="p2"><span class="apple-converted-space"><span style="color:black">
</span></span><span class="s1"><<b>UpgradeProtocol</b> </span><span class="s3"><b>className</b></span><span class="s1">=</span>"org.apache.coyote.http2.Http2Protocol"<span class="s1"> /></span><o:p></o:p></p>
<p class="p4"><span class="apple-converted-space"> </span></<b>Connector</b>><o:p></o:p></p>
<p class="p3"><o:p> </o:p></p>
<p class="p2"><span class="apple-converted-space"><span style="color:black"> </span>
</span><span class="s1"><<b>Engine</b> </span><span class="s3"><b>name</b></span><span class="s1">=</span>"Catalina"<span class="s1">
</span><span class="s3"><b>defaultHost</b></span><span class="s1">=</span>"localhost"<span class="s1">></span><o:p></o:p></p>
<p class="p3"><o:p> </o:p></p>
<p class="p2"><span class="apple-converted-space"><span style="color:black">
</span></span><span class="s1"><<b>Host</b> </span><span class="s3"><b>name</b></span><span class="s1">=</span>"localhost"<span class="apple-converted-space"><span style="color:black">
</span></span><span class="s3"><b>appBase</b></span><span class="s1">=</span>"webapps"<o:p></o:p></p>
<p class="p1"><span class="apple-converted-space"><span style="color:black">
</span></span><b>unpackWARs</b><span class="s1">=</span><span class="s2">"true"</span><span class="s1">
</span><b>autoDeploy</b><span class="s1">=</span><span class="s2">"true"</span><span class="s1">></span><o:p></o:p></p>
<p class="p3"><o:p> </o:p></p>
<p class="p5"><span class="apple-converted-space"><span style="color:black">
</span></span><!-- add valve x-forwarded-for --><o:p></o:p></p>
<p class="p2"><span class="apple-converted-space"><span style="color:black">
</span></span><span class="s1"><<b>Valve</b> </span><span class="s3"><b>className</b></span><span class="s1">=</span>"org.apache.catalina.valves.RemoteIpValve"<o:p></o:p></p>
<p class="p2"><span class="apple-converted-space"><span style="color:black">
</span></span><span class="s3"><b>internalProxies</b></span><span class="s1">=</span>"10\.140\.\d{1,3}\.\d{1,3}"<o:p></o:p></p>
<p class="p2"><span class="apple-converted-space"><span style="color:black">
</span></span><span class="s3"><b>remoteIpHeader</b></span><span class="s1">=</span>"x-forwarded-for"<o:p></o:p></p>
<p class="p4"><span class="apple-converted-space"> </span><span class="s3"><b>proxiesHeader</b></span>=<span class="s2">"x-forwarded-by"</span><span class="apple-converted-space"> </span><o:p></o:p></p>
<p class="p2"><span class="apple-converted-space"><span style="color:black">
</span></span><span class="s3"><b>protocolHeader</b></span><span class="s1">=</span>"x-forwarded-proto"<span class="apple-converted-space"><span style="color:black"> </span></span><o:p></o:p></p>
<p class="p2"><span class="apple-converted-space"><span style="color:black">
</span></span><span class="s3"><b>hostHeader</b></span><span class="s1">=</span>"x-forwarded-host"<o:p></o:p></p>
<p class="p2"><span class="apple-converted-space"><span style="color:black">
</span></span><span class="s3"><b>trustedProxies</b></span><span class="s1">=</span>"proxy1|proxy2|proxy3"<span class="s1"> /></span><o:p></o:p></p>
<p class="p3"><o:p> </o:p></p>
<p class="p2"><span class="apple-converted-space"><span style="color:black">
</span></span><span class="s1"><<b>Valve</b> </span><span class="s3"><b>className</b></span><span class="s1">=</span>"org.apache.catalina.valves.AccessLogValve"<o:p></o:p></p>
<p class="p2"><span class="apple-converted-space"><span style="color:black">
</span></span><span class="s3"><b>directory</b></span><span class="s1">=</span>"/tmp"<span class="s1">
</span><span class="s3"><b>prefix</b></span><span class="s1">=</span>"tomcat_access_log"<o:p></o:p></p>
<p class="p2"><span class="apple-converted-space"><span style="color:black">
</span></span><span class="s3"><b>rotatable</b></span><span class="s1">=</span>"false"<span class="s1">
</span><span class="s3"><b>pattern</b></span><span class="s1">=</span>"%h %l %u %t "%r" %s %b remote_ip:%a x-forwarded-for:%{x-forwarded-for}i x-forwarded-host:%{x-forwarded-host}i x-forwarded-proto:%{x-forwarded-proto}i HBS_PERSON_ID: %{HBS_PERSON_ID}i
"<span class="s1"> /></span><span class="apple-converted-space"><span style="color:black"> </span></span><o:p></o:p></p>
<p class="p3"><o:p> </o:p></p>
<p class="p4"><span class="apple-converted-space"> </span></<b>Host</b>><o:p></o:p></p>
<p class="p4"><span class="apple-converted-space"> </span></<b>Engine</b>><o:p></o:p></p>
<p class="p4"><span class="apple-converted-space"> </span></<b>Service</b>><o:p></o:p></p>
<p class="p4"></<b>Server</b>><o:p></o:p></p>
<p class="p3"><o:p> </o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt">I also tried using the cert and server.xml in the image and got the same error. Has anyone run into the same issue?<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Thanks, Sunil<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
</div>
</body>
</html>