Hello, We have a confirmed working installation of CAS and are attempting to add TLS between the database, REDIS and CAS.
This is what I've done: I've enabled TLS in the redis.conf port 0 tls-port 6379 tls-cert-file /etc/redis/tls/tls-cert-file.crt tls-key-file /etc/redis/tls/tls-key-file.key tls-ca-cert-file /etc/redis/tls/CACert.crt tls-auth-clients no The tls-cert-file.crt and tls-key-file.key were generated by this command: openssl req -nodes -x509 -newkey rsa:4096 -subj "/C=CA/ST=Province Name/L=City/O=School/CN=cas.servername.edu" -days 365 -keyout /etc/redis/tls/tls-key-file.key -out /etc/redis/tls/tls-cert-file.crt The CACert.crt key was made by this command: openssl genrsa 4096 > CACert.pem openssl req -new -x509 -nodes -days 365 \ -key CACert.pem \ -out CACert.crt I then converted the CACert.crt to a DER format as the Troubleshooting Guide for SSL connections part of the CAS docs state. https://apereo.github.io/cas/6.4.x/installation/Troubleshooting-Guide.html#ssl--certificates And imported the cert into the java key store: keytool -import -keystore /usr/lib/jvm/java-11-openjdk-11.0.12.0.7-0.el7_9.x86_64/lib/security/cacerts -file tmp/cert.der -alias CACert To be sure that tomcat is using that key store, I added these options to the catalina.sh script in .../tomcat9/bin: JAVA_OPTS="$JAVA_OPTS -Djavax.net.ssl.trustStore=/usr/lib/jvm/java-11-openjdk-11.0.12.0.7-0.el7_9.x86_64/lib/security/cacerts" JAVA_OPTS="$JAVA_OPTS -Djavax.net.ssl.trustStorePassword=********" in /etc/cas/config/cas.properties set this flag: cas.ticket.registry.redis.useSsl=true Restarted REDIS and Tomcat. Now when I attempt to authenticate, the catalina.out log indicates that CAS can't connect to localhost:6379 (This is the REDIS port) and that there is what the troubleshooting guide calls the most common SSL error: Caused by: javax.net.ssl.SSLHandshakeException: PKIX path validation failed: java.security.cert.CertPathValidatorException: Path does not chain with any of the trust anchors I believe I've done all of the steps correctly. Anyone know what I'm missing? Below is the log snippet from the authentication attempt. Thanks for any help, Rod Caused by: io.lettuce.core.RedisConnectionException: Unable to connect to localhost:6379 at io.lettuce.core.RedisConnectionException.create(RedisConnectionException.java:78) ~[lettuce-core-5.2.0.RELEASE.jar:5.2.0.RELEASE] at io.lettuce.core.RedisConnectionException.create(RedisConnectionException.java:56) ~[lettuce-core-5.2.0.RELEASE.jar:5.2.0.RELEASE] at io.lettuce.core.AbstractRedisClient.getConnection(AbstractRedisClient.java:234) ~[lettuce-core-5.2.0.RELEASE.jar:5.2.0.RELEASE] at io.lettuce.core.RedisClient.connect(RedisClient.java:207) ~[lettuce-core-5.2.0.RELEASE.jar:5.2.0.RELEASE] at org.springframework.data.redis.connection.lettuce.StandaloneConnectionProvider.lambda$getConnection$1(StandaloneConnectionProvider.java:115) ~[spring-data-redis-2.2.0.RELEASE.jar:2.2.0.RELEASE] at java.util.Optional.orElseGet(Optional.java:369) ~[?:?] at org.springframework.data.redis.connection.lettuce.StandaloneConnectionProvider.getConnection(StandaloneConnectionProvider.java:115) ~[spring-data-redis-2.2.0.RELEASE.jar:2.2.0.RELEASE] at org.springframework.data.redis.connection.lettuce.LettucePoolingConnectionProvider.lambda$null$0(LettucePoolingConnectionProvider.java:97) ~[spring-data-redis-2.2.0.RELEASE.jar:2.2.0.RELEASE] at io.lettuce.core.support.ConnectionPoolSupport$RedisPooledObjectFactory.create(ConnectionPoolSupport.java:209) ~[lettuce-core-5.2.0.RELEASE.jar:5.2.0.RELEASE] at io.lettuce.core.support.ConnectionPoolSupport$RedisPooledObjectFactory.create(ConnectionPoolSupport.java:199) ~[lettuce-core-5.2.0.RELEASE.jar:5.2.0.RELEASE] at org.apache.commons.pool2.BasePooledObjectFactory.makeObject(BasePooledObjectFactory.java:58) ~[commons-pool2-2.7.0.jar:2.7.0] at org.apache.commons.pool2.impl.GenericObjectPool.create(GenericObjectPool.java:889) ~[commons-pool2-2.7.0.jar:2.7.0] at org.apache.commons.pool2.impl.GenericObjectPool.borrowObject(GenericObjectPool.java:424) ~[commons-pool2-2.7.0.jar:2.7.0] at org.apache.commons.pool2.impl.GenericObjectPool.borrowObject(GenericObjectPool.java:349) ~[commons-pool2-2.7.0.jar:2.7.0] at io.lettuce.core.support.ConnectionPoolSupport$1.borrowObject(ConnectionPoolSupport.java:122) ~[lettuce-core-5.2.0.RELEASE.jar:5.2.0.RELEASE] at io.lettuce.core.support.ConnectionPoolSupport$1.borrowObject(ConnectionPoolSupport.java:117) ~[lettuce-core-5.2.0.RELEASE.jar:5.2.0.RELEASE] at org.springframework.data.redis.connection.lettuce.LettucePoolingConnectionProvider.getConnection(LettucePoolingConnectionProvider.java:103) ~[spring-data-redis-2.2.0.RELEASE.jar:2.2.0.RELEASE] ... 209 more Caused by: javax.net.ssl.SSLHandshakeException: PKIX path validation failed: java.security.cert.CertPathValidatorException: Path does not chain with any of the trust anchors at sun.security.ssl.Alert.createSSLException(Alert.java:131) ~[?:?] at sun.security.ssl.TransportContext.fatal(TransportContext.java:349) ~[?:?] at sun.security.ssl.TransportContext.fatal(TransportContext.java:292) ~[?:?] at sun.security.ssl.TransportContext.fatal(TransportContext.java:287) ~[?:?] at sun.security.ssl.CertificateMessage$T12CertificateConsumer.checkServerCerts(CertificateMessage.java:654) ~[?:?] at sun.security.ssl.CertificateMessage$T12CertificateConsumer.onCertificate(CertificateMessage.java:473) ~[?:?] at sun.security.ssl.CertificateMessage$T12CertificateConsumer.consume(CertificateMessage.java:369) ~[?:?] at sun.security.ssl.SSLHandshake.consume(SSLHandshake.java:392) ~[?:?] at sun.security.ssl.HandshakeContext.dispatch(HandshakeContext.java:443) ~[?:?] at sun.security.ssl.SSLEngineImpl$DelegatedTask$DelegatedAction.run(SSLEngineImpl.java:1074) ~[?:?] at sun.security.ssl.SSLEngineImpl$DelegatedTask$DelegatedAction.run(SSLEngineImpl.java:1061) ~[?:?] at java.security.AccessController.doPrivileged(Native Method) ~[?:?] at sun.security.ssl.SSLEngineImpl$DelegatedTask.run(SSLEngineImpl.java:1008) ~[?:?] at io.netty.handler.ssl.SslHandler.runAllDelegatedTasks(SslHandler.java:1499) ~[netty-handler-4.1.42.Final.jar:4.1.42.Final] at io.netty.handler.ssl.SslHandler.runDelegatedTasks(SslHandler.java:1513) ~[netty-handler-4.1.42.Final.jar:4.1.42.Final] at io.netty.handler.ssl.SslHandler.unwrap(SslHandler.java:1397) ~[netty-handler-4.1.42.Final.jar:4.1.42.Final] at io.netty.handler.ssl.SslHandler.decodeJdkCompatible(SslHandler.java:1224) ~[netty-handler-4.1.42.Final.jar:4.1.42.Final] at io.netty.handler.ssl.SslHandler.decode(SslHandler.java:1271) ~[netty-handler-4.1.42.Final.jar:4.1.42.Final] at io.netty.handler.codec.ByteToMessageDecoder.decodeRemovalReentryProtection(ByteToMessageDecoder.java:505) ~[netty-codec-4.1.42.Final.jar:4.1.42.Final] at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:444) ~[netty-codec-4.1.42.Final.jar:4.1.42.Final] at io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:283) ~[netty-codec-4.1.42.Final.jar:4.1.42.Final] at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:374) ~[netty-transport-4.1.42.Final.jar:4.1.42.Final] at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:360) ~[netty-transport-4.1.42.Final.jar:4.1.42.Final] at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:352) ~[netty-transport-4.1.42.Final.jar:4.1.42.Final] at io.netty.channel.DefaultChannelPipeline$HeadContext.channelRead(DefaultChannelPipeline.java:1422) ~[netty-transport-4.1.42.Final.jar:4.1.42.Final] at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:374) ~[netty-transport-4.1.42.Final.jar:4.1.42.Final] at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:360) ~[netty-transport-4.1.42.Final.jar:4.1.42.Final] at io.netty.channel.DefaultChannelPipeline.fireChannelRead(DefaultChannelPipeline.java:931) ~[netty-transport-4.1.42.Final.jar:4.1.42.Final] at io.netty.channel.nio.AbstractNioByteChannel$NioByteUnsafe.read(AbstractNioByteChannel.java:163) ~[netty-transport-4.1.42.Final.jar:4.1.42.Final] at io.netty.channel.nio.NioEventLoop.processSelectedKey(NioEventLoop.java:700) ~[netty-transport-4.1.42.Final.jar:4.1.42.Final] at io.netty.channel.nio.NioEventLoop.processSelectedKeysOptimized(NioEventLoop.java:635) ~[netty-transport-4.1.42.Final.jar:4.1.42.Final] at io.netty.channel.nio.NioEventLoop.processSelectedKeys(NioEventLoop.java:552) ~[netty-transport-4.1.42.Final.jar:4.1.42.Final] at io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:514) ~[netty-transport-4.1.42.Final.jar:4.1.42.Final] at io.netty.util.concurrent.SingleThreadEventExecutor$6.run(SingleThreadEventExecutor.java:1044) ~[netty-common-4.1.42.Final.jar:4.1.42.Final] at io.netty.util.internal.ThreadExecutorMap$2.run(ThreadExecutorMap.java:74) ~[netty-common-4.1.42.Final.jar:4.1.42.Final] at io.netty.util.concurrent.FastThreadLocalRunnable.run(FastThreadLocalRunnable.java:30) ~[netty-common-4.1.42.Final.jar:4.1.42.Final] ... 1 more Caused by: sun.security.validator.ValidatorException: PKIX path validation failed: java.security.cert.CertPathValidatorException: Path does not chain with any of the trust anchors -- - Website: https://apereo.github.io/cas - Gitter Chatroom: https://gitter.im/apereo/cas - List Guidelines: https://goo.gl/1VRrw7 - Contributions: https://goo.gl/mh7qDG --- You received this message because you are subscribed to the Google Groups "CAS Community" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/ceb62d74-5af2-4f4e-b6fb-a9d179941bd8n%40apereo.org.
