Shibboleth SP V3 Beta available for Windows

[Cantor, Scott]

> Have you decided on the names for the auto-generated key pairs?

Well, I picked names, it's not set in stone though it's a little bit of a pain to change them so I would rather get them re-decided once and then change them if I have to. Currently new installs get sp-signing-cert/key.pem and sp-encrypt-cert/key.pem, and upgrades of course are untouched.

> If 'sp-cert.pem' and 'sp-key.pem' remain the defaults for the encryption key
> then people following documentation that has not been updated yet (or that
> will never be updated...) will still "find" the correct cert for the metadata.

I think that's going to be confusing, personally. I don't care that much what the names are, but neither should be what they are now.

> Another approach might be to not auto-generate the signing keys but instead
> provide and document a simple "wrapper" (around OpenSSL) script to generate
> the signing keys if/when necessary.

I didn't see much value in making people jump through hoops to get them generated, but the wrapper is already there. If people really think it should "just generate" an encryption key, I could do that, but I am definitely against naming it generically. I would agree that if I was to leave *either* name alone, it would be the encryption key, but I don't think that's a good idea.

-- Scott