Shibboleth Developers

[Scott Cantor <>]

Turns out OpenSSL has an errstr command to dump out the message from the
code being logged by OpenSAML.

This led quickly to determining that shib2 was rejecting the PSU AA's
SSL cert, and this was because I forgot to check if libcurl supports
chains. It doesn't. At least we're consistent.

Anyway, adding PSU's CA to my SHAR CA bundle fixed the problem. I'm less
nervous now. Note that OpenSSL worked fine with all these bogus PSU
certs, so I think they need to get on the ball here.

Do we have a troubleshooting section in the deploy guide? Should we
start one?

-- Scott

------------------------------------------------------mace-shib-design-+
For list utilities, archives, subscribe, unsubscribe, etc. please visit the
ListProc web interface at 

    http://archives.internet2.edu/

------------------------------------------------------mace-shib-design--