Hi,
service A is using proxy authentication to access service X. In this case
the (CAS) implementation is using a HTTP GET request to the proxyreceptor
of service A (via SSL of cource). Because service a is using a self signed
certificate, this certificate is imported in a trustcore which is used by
my CAS server:
http.client.truststore.file=file:${catalina.base}/conf/truststore.localhost.jks
This works fine.
Now I am trying to implement a Single Logout.
When the CAS server tries to send the logout message to all services (of
this "session" / asynchronous), this results in an certificate_unknown
error on service A.
pool-3-thread-1, SEND TLSv1.2 ALERT: fatal, description =
certificate_unknown
pool-3-thread-1, handling exception: javax.net.ssl.SSLHandshakeException:
sun.security.validator.ValidatorException: PKIX path building failed:
sun.security.provider.certpath.SunCertPathBuilderException: unable to find
valid certification path to requested target
Because this is exactly the same server, this is very strange.
There seems to be at least two differences in the request to the
proxyrecptor and the logout on the same service (looking at
SimpleHttpClient):
1. proxyreceptor is executing an HTTP get, logout is executing a POST.
2. proxyreceptor is using httpClient.execute - logout is using
HttpRequestFutureTask.execute
Is it possible that HttpRequestFutureTask.execute is not using the
http.client.truststore.file definition? Or do you have any other ideas?
Best regards,
Axel
--
You received this message because you are subscribed to the Google Groups "CAS
Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
Visit this group at https://groups.google.com/a/apereo.org/group/cas-user/.
