I just realized I was looking at the Apache univention-saml.conf on the backup, not the master. The conf on the master has no SSLCertificateFile, SSLCertificateKeyFile, or SSLCACertificateFile directives at all. I guess that must be the problem.
Just in case it’s still relevant, here is the output of those commands.
On the master DC:
# openssl s_client -connect ucs-sso.$(ucr get domainname):443 < /dev/null | openssl x509 -in - -noout -text | grep -iEA 2 subjectdepth=1 C = CA, ST = Alberta, L = [my city], O = [my surname] Home, OU = Univention Corporate Server, CN = Univention Corporate Server Root CA (ID=kggd5SxB), emailAddress = ssl@[my domain]
verify return:1
depth=0 C = CA, ST = Alberta, L = [my city], O = [my surname] Home, OU = Univention Corporate Server, CN = [master hostname].[my domain], emailAddress = ssl@[my domain]
verify return:1
Subject: C = CA, ST = Alberta, L = [my city], O = [my surname] Home, OU = Univention Corporate Server, CN = [master hostname].[my domain], emailAddress = ssl@[my domain]
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
Public-Key: (2048 bit)
--
X509v3 Subject Key Identifier:
DONE
64:9A:E5:1A:CB:E7:D6:BC:02:C4:02:97:5C:D9:59:17:3E:79:51:DD
X509v3 Authority Key Identifier:
--
X509v3 Subject Alternative Name:
DNS:[master hostname].[my domain], DNS:[master hostname]
Signature Algorithm: sha256WithRSAEncryption
# openssl x509 -in /etc/univention/ssl/ucs-sso.$(ucr get domainname)/cert.pem -noout -text | grep -iEA 2 subject
Subject: C = CA, ST = Alberta, L = [my city], O = [my surname] Home, OU = Univention Corporate Server, CN = ucs-sso.[my domain], emailAddress = ssl@[my domain]
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
Public-Key: (2048 bit)
--
X509v3 Subject Key Identifier:
B9:BB:49:17:19:EE:D3:85:3B:4A:70:C0:BB:B2:1A:5D:FF:8B:8B:E3
X509v3 Authority Key Identifier:
--
X509v3 Subject Alternative Name:
DNS:ucs-sso.[my domain], DNS:ucs-sso
Signature Algorithm: sha256WithRSAEncryption
On the backup DC:
# openssl s_client -connect ucs-sso.$(ucr get domainname):443 < /dev/null | openssl x509 -in - -noout -text | grep -iEA 2 subject
depth=1 C = CA, ST = Alberta, L = [my city], O = [my surname] Home, OU = Univention Corporate Server, CN = Univention Corporate Server Root CA (ID=kggd5SxB), emailAddress = ssl@[my domain]
verify error:num=19:self signed certificate in certificate chain
DONE
Subject: C = CA, ST = Alberta, L = [my city], O = [my surname] Home, OU = Univention Corporate Server, CN = [backup hostname].[my domain], emailAddress = ssl@[my domain]
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
Public-Key: (2048 bit)
--
X509v3 Subject Key Identifier:
CA:16:C8:D1:DF:AD:35:8C:4C:53:5D:05:6F:69:7F:2E:25:B8:FC:B3
X509v3 Authority Key Identifier:
--
X509v3 Subject Alternative Name:
DNS:[backup hostname].[my domain], DNS:[backup hostname]
Signature Algorithm: sha256WithRSAEncryption
# openssl x509 -in /etc/univention/ssl/ucs-sso.$(ucr get domainname)/cert.pem -noout -text | grep -iEA 2 subject
Subject: C = CA, ST = Alberta, L = [my city], O = [my surname] Home, OU = Univention Corporate Server, CN = ucs-sso.[my domain], emailAddress = ssl@[my domain]
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
Public-Key: (2048 bit)
--
X509v3 Subject Key Identifier:
B9:BB:49:17:19:EE:D3:85:3B:4A:70:C0:BB:B2:1A:5D:FF:8B:8B:E3
X509v3 Authority Key Identifier:
--
X509v3 Subject Alternative Name:
DNS:ucs-sso.[my domain], DNS:ucs-sso
Signature Algorithm: sha256WithRSAEncryption
I really appreciate all the effort you’re putting into this. I’d be lost without you.
