between possible 1.0 and 1.1, open id path is changed with /esgcet/ in between.
this update didn't get reflected in database schema migration, ie. security.users dn column still carries the old open id URL, but proxy certificate's DN is newer one. This inconsistency will cause the publishing error (Hessian lib complains about ProtocolError) for "old users" only.

the temporary workaround is to go into the database and make manual changes.
however, for system doing the upgrade, this problem will come back until the migration done right.