Shib MDA 0.8.0 can check the certificate's metadata expiration?

[Tom Scavo]

On Mon, Jan 20, 2014 at 10:14 AM, Ian Young <ian at iay.org.uk> wrote:
>
> On 20 Jan 2014, at 15:05, Marco Malavolti <marco.malavolti at garr.it> wrote:
>
>> - Can MDA check the expiration time of the metadata's certificates?
>
> We don't have a stage to do this yet. There is a JIRA case for it that you can add comments to, though:
>
> https://issues.shibboleth.net/jira/browse/MDA-75

Since some software will actually try to check any CRLs or OCSP
endpoints that might be contained in the certificate, checking for
self-signed certificates is in exactly the same boat, I think. Is
there a stage for that?

Beyond conformance with MetaIOP, there are two other certificate-related issues:

- redundant certificates should be avoided (since some software will
not consume an <md:EntityDescriptor> element containing more than one
encryption key)

- certificates should not be shared (since some software will not
consume two <md:EntityDescriptor> elements that contain the same
certificate)

The latter is particularly onerous since it can't be determined by
examining a single EntityDescriptor.

In all cases, when I say "some software," I'm referring to a specific,
well-known implementation that exhibits all of these issues (including
the expired certificate issue in MDA-75).

Tom