Question about generation of certificate for IdP

[Rod Widdowson]

In addition to what Chad says, I'll note that as far as the more recent Tomcat's are concerned (and I'll bet that the same is true
for Jetty - I just don't _know_) you can use a PKCS12 file instead of a JKS one which will save you going mad working out (again)
how Keytool works.

Note that sometimes the issues raised by the security guys can be based on a lack of understanding (a common one is "20 years is too
long for a self signed cert"), but that is a conversation which you may not even want to get into...

R

> -----Original Message-----
> From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Chad La Joie
> Sent: 25 August 2011 16:19
> To: Shib Users
> Subject: Re: Question about generation of certificate for IdP
> 
> The cert in metadata is the Base64 encoder DER encode of the cert
> (a.k.a. PEM encoded without the file header/footer).
> 
> For the IdP, the only file that the IdP itself uses is are the PEM
> encoded cert/key file.  The JKS file, if used, is used by the servlet
> container on the back-channel port.
> 
> On Thu, Aug 25, 2011 at 11:15, WULMS Alexander
> <Alexander.WULMS at swift.com> wrote:
> > Hi,
> >
> >
> >
> > I have read in the documentation that it is possible to (re)generate the IdP
> > certificate with the install.bat/install.sh program and noticed that that
> > eventually leads to the invocation of the <selfSignedCert> ant task.
> >
> >
> >
> > The security guys here have some requirements regarding the key and
> > certificate generation which, as far as I can see, are not configurable
> > through that ant task.
> >
> >
> >
> > Can I instead generate the certificate for example with openSSL? If yes, in
> > which format should I store it in the IdP metadata.xml file? At first glance
> > it looks like its base64 encoded but can you confirm that that is indeed
> > like that? Furthermore, should I also import the key and certificate into
> > the idp.jks javakeystore file? Or is it sufficient to have the idp.crt and
> > idp.key files in the credentials folder?
> >
> >
> >
> >
> >
> > Thanks and kind regards,
> >
> > Alex
> >
> >
> >
> > Alex Wulms
> > Lead Developer, Swift.com development
> > Tel: + 32 2 655 3931
> >
> > S.W.I.F.T. SCRL
> >
> > This e-mail and any attachments thereto may contain information which is
> > confidential and/or proprietary and intended for the sole use of the
> > recipient(s) named above. If you have received this e-mail in error, please
> > immediately notify the sender and delete the mail.  Thank you for your
> > co-operation.  SWIFT reserves the right to retain e-mail messages on its
> > systems and, under circumstances permitted by applicable law, to monitor and
> > intercept e-mail messages to and from its systems.
> >
> >
> > Please visit http://www.swift.com for more information about SWIFT.
> >
> >
> >
> > --
> > To unsubscribe from this list send an email to
> > users-unsubscribe at shibboleth.net
> >
> 
> 
> 
> --
> Chad La Joie
> www.itumi.biz
> trusted identities, delivered
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net