Cert rollover sanity check

[Mike Flynn]

My cert in InCommon is expired and as such I am looking to update 
it.  I probably would never have noticed it was expired had I not tried 
to integrate with Ball State.  They are using an AD FS based Idp and it 
balked at the expired cert.  Below is the process that I intend to 
follow.  Just looking to get a sanity check on my process before I 
proceed since the potential impact could be ugly if I make a misstep 
here.  Moreover, once I have completed this process, will Ball State 
have to wait until I remove the old cert / old cert config after the 3 
week propagation period?  I am on IIS running Shib 2.


Here is my proposed process:

1. Create new credentials:

cd C:\Temp
C:\opt\shibboleth-sp\etc\shibboleth\keygen.bat -y 20 -h www.lynda.com -e https://shib.lynda.com/shibboleth-sp
mv sp-cert.pem C:\opt\shibboleth-sp\etc\shibboleth\sp-cert-2011.pem
mv sp-key.pem C:\opt\shibboleth-sp\etc\shibboleth\sp-key-2011.pem

2. Update Shibboleth2.xml"
        
        Change old setting FROM:
        
         <!-- Your SP generated these credentials.  They're used to talk to IdP's. -->
         <CredentialResolver type="File" key="sp-key.pem" certificate="sp-cert.pem"/>
        
        TO:

        
        <CredentialResolver type="Chaining">
        <!-- 
             Certificate/Private key pairs are read in sequence.
             Unless specificially defined only the first 
             CredentialResolver is used for attribute requests.
        -->
             <CredentialResolver type="File" keyName="Active" 
                                 key="C:\opt\shibboleth-sp\etc\shibboleth\sp-key.pem" 
                                 certificate="C:\opt\shibboleth-sp\etc\shibboleth\sp-cert.pem"/>
             <CredentialResolver type="File" keyName="Standby" 
                                 key="C:\opt\shibboleth-sp\etc\shibboleth\sp-key-2011.pem" 
                                 certificate="C:\opt\shibboleth-sp\etc\shibboleth\sp-cert-2011.pem"/>
       
 </CredentialResolver>
        
3. Add new cert to Incommon:

Add new <md:Keydescriptor> (bereft of the use="signing" XML element)
Change old <md:Keydescriptor> - Add use="signing" XML element (using dropdown in interface)

4. Wait 3 weeks for propogation:

5. Update Shibboleth2.xml to remove old credential reference:

        Change old setting FROM:

        <CredentialResolver type="Chaining">
        <!-- 
             Certificate/Private key pairs are read in sequence.
             Unless specificially defined only the first 
             CredentialResolver is used for
 attribute requests.
        -->
             <CredentialResolver type="File" keyName="Active" 
                                 key="C:\opt\shibboleth-sp\etc\shibboleth\sp-key.pem" 
                                 certificate="C:\opt\shibboleth-sp\etc\shibboleth\sp-cert.pem"/>
             <CredentialResolver type="File" keyName="Standby" 
                                 key="C:\opt\shibboleth-sp\etc\shibboleth\sp-key-2011.pem" 
                                 certificate="C:\opt\shibboleth-sp\etc\shibboleth\sp-cert-2011.pem"/>
        </CredentialResolver>

        TO:
        
         <!-- Your SP generated these credentials.  They're used to talk to IdP's. -->
         <CredentialResolver type="File" key="sp-key-2011.pem"
 certificate="sp-cert-2011.pem"/>
        
6. Remove old <md:Keydescriptor> (with use="signing" XML element) from InCommon

If anyone sees any issues with my process here, any comments are appreciated!

Thanks!
Mike
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20111020/a740209b/attachment.html