Question about generation of certificate for IdP

[Chad La Joie]

The cert in metadata is the Base64 encoder DER encode of the cert
(a.k.a. PEM encoded without the file header/footer).

For the IdP, the only file that the IdP itself uses is are the PEM
encoded cert/key file.  The JKS file, if used, is used by the servlet
container on the back-channel port.

On Thu, Aug 25, 2011 at 11:15, WULMS Alexander
<Alexander.WULMS at swift.com> wrote:
> Hi,
>
>
>
> I have read in the documentation that it is possible to (re)generate the IdP
> certificate with the install.bat/install.sh program and noticed that that
> eventually leads to the invocation of the <selfSignedCert> ant task.
>
>
>
> The security guys here have some requirements regarding the key and
> certificate generation which, as far as I can see, are not configurable
> through that ant task.
>
>
>
> Can I instead generate the certificate for example with openSSL? If yes, in
> which format should I store it in the IdP metadata.xml file? At first glance
> it looks like its base64 encoded but can you confirm that that is indeed
> like that? Furthermore, should I also import the key and certificate into
> the idp.jks javakeystore file? Or is it sufficient to have the idp.crt and
> idp.key files in the credentials folder?
>
>
>
>
>
> Thanks and kind regards,
>
> Alex
>
>
>
> Alex Wulms
> Lead Developer, Swift.com development
> Tel: + 32 2 655 3931
>
> S.W.I.F.T. SCRL
>
> This e-mail and any attachments thereto may contain information which is
> confidential and/or proprietary and intended for the sole use of the
> recipient(s) named above. If you have received this e-mail in error, please
> immediately notify the sender and delete the mail.  Thank you for your
> co-operation.  SWIFT reserves the right to retain e-mail messages on its
> systems and, under circumstances permitted by applicable law, to monitor and
> intercept e-mail messages to and from its systems.
>
>
> Please visit http://www.swift.com for more information about SWIFT.
>
>
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>



-- 
Chad La Joie
www.itumi.biz
trusted identities, delivered