Shibboleth IDP signing and encryption keys protected by a password

[Cantor, Scott]

> Is there any way to generate and use idp-signing.key and idp-encryption.key
> files protected by a password?

Keys that aren't in keystores can be generated with openssl and encrypted with a password in the normal way. I don't believe that I included any such feature in the Java class used by the installer. I assume, but don't really know, that the classes that load the keys have the ability to have a password set in the Spring config, both old and new.

My general view is that protecting things with passwords that have to be stored in a configuration file is stupid. If you're one of the rare folks actually willing to forego unattended restart of the system, you are exempt from that conclusion, but that's why it doesn't default to that.

The keystores that are passworded are so because Java doesn't give us a choice.

-- Scott