[JIRA] Created: (MDA-75) need a stage to check for expired or nearly expired certificates in SAML metadata

[Ian Young (JIRA)]

need a stage to check for expired or nearly expired certificates in SAML metadata
---------------------------------------------------------------------------------

                 Key: MDA-75
                 URL: https://issues.shibboleth.net/jira/browse/MDA-75
             Project: Metadata Aggregator
          Issue Type: New Feature
          Components: SAML Metadata
    Affects Versions: 0.7
            Reporter: Ian Young
            Assignee: Chad La Joie


Although software complying with the metadata interoperability profile pays no attention to most parts of an X.509 certificate holding a public key, some software does check for expiration in particular.  In practice, this means that federations need to look for certificates which have expired, or which are close to expiry.

I suggest that we create a stage to do this.  We should permit the setting of the severity of expiry and "near" expiry, and the window during which "near" expiry should be indicated.

I suppose it would be possible to have just one stage and use it for both purposes (with a zero-size window in one case) but getting sensible output (without multiple errors and warnings for expired certificates) would require filtering out anything that was detected by the first stage instance before applying the second.  It's going to be easier to get presentable output by combining the two.  I'm open to persuasion, though.

--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira