<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<div class="moz-cite-prefix">Note that the filenames in the debug
log do not match the filenames in your shibboleth2.xml file, which
suggests the file you're looking at is not the one that shibd is
actually using. The log says it is reading from
/etc/shibboleth/shibboleth2.xml.</div>
<div class="moz-cite-prefix"><br>
</div>
<div class="moz-cite-prefix">The other possibility is that the
contents of the key or cert files are not in the expected format.
If something happened to the files, you can generate new ones
using the keygen script:</div>
<div class="moz-cite-prefix"><br>
</div>
<div class="moz-cite-prefix"><a class="moz-txt-link-freetext" href="https://shibboleth.atlassian.net/wiki/spaces/SP3/pages/2067398706/keygen">https://shibboleth.atlassian.net/wiki/spaces/SP3/pages/2067398706/keygen</a></div>
<div class="moz-cite-prefix"><br>
</div>
<div class="moz-cite-prefix">The log messages are consistent with
the certificate file containing a private key instead of a
certificate.<br>
</div>
<div class="moz-cite-prefix"><br>
</div>
<div class="moz-cite-prefix">On 11/28/2022 3:36 PM, Bhagwat,
Shrikant wrote:<br>
</div>
<blockquote type="cite"
cite="mid:DM5PR08MB3595BD19359014E7ABB2D7118A139@DM5PR08MB3595.namprd08.prod.outlook.com">
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<meta name="Generator" content="Microsoft Word 15 (filtered
medium)">
<style>@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0in;
font-size:10.0pt;
font-family:"Courier New";}span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:Consolas;}span.EmailStyle22
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}div.WordSection1
{page:WordSection1;}</style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
<div class="WordSection1">
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Below is from shibboleth2.xml file<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"> <!-- Simple file-based resolvers for
separate signing/encryption keys. --><o:p></o:p></p>
<p class="MsoNormal"> <CredentialResolver type="File"
use="signing"<o:p></o:p></p>
<p class="MsoNormal"> key="sp-signing-key.pem"
certificate="sp-signing-cert.pem"/><o:p></o:p></p>
<p class="MsoNormal"> <CredentialResolver type="File"
use="encryption"<o:p></o:p></p>
<p class="MsoNormal"> key="sp-encrypt-key.pem"
certificate="sp-encrypt-cert.pem"/><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">This is what is getting loaded <o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"
style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Why
we are getting error : 151584876 in ../crypto/pem/pem_lib.c,
line 745<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div style="border:none;border-top:solid #E1E1E1
1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b>From:</b> Christopher Bongaarts
<a class="moz-txt-link-rfc2396E" href="mailto:cab@umn.edu"><cab@umn.edu></a> <br>
<b>Sent:</b> Monday, November 28, 2022 4:11 PM<br>
<b>To:</b> Shib Users <a class="moz-txt-link-rfc2396E" href="mailto:users@shibboleth.net"><users@shibboleth.net></a><br>
<b>Cc:</b> Bhagwat, Shrikant
<a class="moz-txt-link-rfc2396E" href="mailto:shrbhagw@med.umich.edu"><shrbhagw@med.umich.edu></a><br>
<b>Subject:</b> Re: ERROR OpenSSL : error code: 151584876
in ../crypto/pem/pem_lib.c, line 745 for SP Signing
Certificate<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal" style="text-align:center" align="center"><strong><span
style="font-size:18.0pt;font-family:"Calibri",sans-serif;color:black;background:white">External
Email - Use Caution
</span></strong><span
style="font-size:18.0pt;color:black;background:white"><o:p></o:p></span></p>
<div>
<div>
<p class="MsoNormal">On 11/28/2022 1:27 PM, Bhagwat,
Shrikant via users wrote:<o:p></o:p></p>
</div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<p class="MsoNormal"
style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">2022-11-28
18:58:49 INFO XMLTooling.SecurityHelper : loading private
key from file (/etc/shibboleth/sp-encrypt-key.pem)<o:p></o:p></p>
<p class="MsoNormal"
style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">2022-11-28
18:58:49 INFO XMLTooling.SecurityHelper : loading
certificate(s) from file
(/etc/shibboleth/sp-encrypt-key.pem)<o:p></o:p></p>
<p class="MsoNormal"
style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">2022-11-28
18:58:49 ERROR OpenSSL : error code: 151584876 in
../crypto/pem/pem_lib.c, line 745<o:p></o:p></p>
<p class="MsoNormal"
style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">2022-11-28
18:58:49 ERROR OpenSSL : error data: Expecting:
CERTIFICATE<o:p></o:p></p>
<p class="MsoNormal"
style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">2022-11-28
18:58:49 ERROR XMLTooling.CredentialResolver.Chaining :
caught exception processing embedded CredentialResolver
element: Unable to load certificate(s) from file
(/etc/shibboleth/sp-encrypt-key.pem).<o:p></o:p></p>
<p class="MsoNormal">[...]<br>
Any Idea ?<o:p></o:p></p>
</blockquote>
<p><o:p> </o:p></p>
<p>Looks like you're trying to load a private key file as the
certificate - you probably want sp-encrypt-cert.pem instead
for the cert file in your CredentialResolver.<o:p></o:p></p>
<pre>-- <o:p></o:p></pre>
<pre>%% Christopher A. Bongaarts %% <a href="mailto:cab@umn.edu" moz-do-not-send="true" class="moz-txt-link-freetext">cab@umn.edu</a> %%<o:p></o:p></pre>
<pre>%% OIT - Identity Management %% <a href="http://umn.edu/~cab" moz-do-not-send="true" class="moz-txt-link-freetext">http://umn.edu/~cab</a> %%<o:p></o:p></pre>
<pre>%% University of Minnesota %% +1 (612) 625-1809 %%<o:p></o:p></pre>
</div>
</div>
<p>**********************************************************<br>
Electronic Mail is not secure, may not be read every day, and
should not be used for urgent or sensitive issues </p>
</blockquote>
<p><br>
</p>
<pre class="moz-signature" cols="72">--
%% Christopher A. Bongaarts %% <a class="moz-txt-link-abbreviated" href="mailto:cab@umn.edu">cab@umn.edu</a> %%
%% OIT - Identity Management %% <a class="moz-txt-link-freetext" href="http://umn.edu/~cab">http://umn.edu/~cab</a> %%
%% University of Minnesota %% +1 (612) 625-1809 %%
</pre>
</body>
</html>