Web server on different machine to CAS server

[Marvin S. Addison]

If you suspect a keystore/certificate issue of any kind, the Java SSL
debug output is indispensable in diagnosing the problem.  Could you
perform a SSL debug trace by adding

-Djavax.net.debug=ssl

to your JVM startup parameters.  This is easily done for Tomcat: create
a $TOMCAT_HOME/bin/setenv.sh file and add the line

CATALINA_OPTS=$CATALINA_OPTS" -Djavax.net.debug=ssl"

This will generate _a lot_ of data in $TOMCAT_HOME/logs/catalina.out by
default.  If you could post what you think are relevant bits of that
output, we might be able to help further.

Regards,
Marvin Addison
-- 
Applications Programming Analyst
Collaborative Technologies Unit
Virginia Tech