The Shibboleth V1 software has reached its End of Life and is no longer supported. This documentation is available for historical purposes only.
CertificateVerifyFailed
- Scott Cantor
- Ian Young
Owned by Scott Cantor
This indicates that the peer (IdP) rejected the certificate the SP presented, but did so using a layer of code inside the Apache mod_ssl module. This should never happen unless the IdP is wrongly configured by allowing mod_ssl to validate the certificate. You need to make sure the SSLVerifyClient option is set to "optional_no_ca".
If you think it is set, you're either wrong, or the certificate violated a built-in requirement that mod_ssl refuses to disable, and you should upgrade to a newer Apache version.
You may also consider running the IdP without Apache, which is now supported and documented.