Shibboleth SP V3 Beta available for Windows

[Scott Koranda]

Hi,

> As a follow up, I would appreciate it if those in a position to care
> about the defaults could review the release notes on some of the
> decisions I made, none of which are set in stone at this point.

Have you decided on the names for the auto-generated key pairs?

If 'sp-cert.pem' and 'sp-key.pem' remain the defaults for the encryption
key then people following documentation that has not been updated yet
(or that will never be updated...) will still "find" the correct cert
for the metadata. 

Otherwise if the names change for the encryption key I am concerned we
will see a rash of instances where the signing key (and only the signing
key) makes it into metadata.

Could the signing key file names be something like

.sp-signing-cert.pem
.sp-signing-key.pem

and so effectively "hide" them until they really need to be found?

Another approach might be to not auto-generate the signing keys but
instead provide and document a simple "wrapper" (around OpenSSL) script
to generate the signing keys if/when necessary. 

The current SWITCH Debian packages do something similar--they do not
auto-generate the encryption cert/privkey, but the wrapper script is
quick and easy to use to generate them after installation.

Thanks,

Scott K