Shibboleth Developers

[Kaspar Brand <>]

> Since life's been boring lately, my favorite open source projects have
> decided to stir things up. Took me a while to track this down, but I believe
> there's an incompatibility between OpenSSL 0.9.8j clients (e.g. libcurl,
> i.e. the SP) and Tomcat TLS/SSL servers (most likely anything using the Sun
> Java SSL implementation).

Looking at the changelog, one candidate for causing handshake troubles
could be

>  Changes between 0.9.8i and 0.9.8j  [07 Jan 2009]
[...]
>   *) Enable TLS extensions by default.
>      [Ben Laurie]

If you add "disable-tlsext" to the OpenSSL config command and recompile,
does the error disappear? With the s_client commannd (from a "stock"
0.9.8j version), you could also try "-no_ticket" and see if that helps
(will disable one of the TLS extensions, which might be the culprit here).

Kaspar