Cert rollover sanity check

[Tom Scavo]

On Thu, Oct 20, 2011 at 12:50 PM, Mike Flynn <shibbolethlynda at yahoo.com> wrote:
>
> If anyone sees any issues with my process here, any comments are
> appreciated!

Your metadata looks good, but I think you want to take another look at
your software configuration. At your step 2, you want to make sure
that the new key is used as a *decryption key only*. You don't want to
sign with the new key because not all IdPs will have the new metadata.
So I suggest you add use="encryption" to the configuration of the new
key.

Once you do that, you can safely move the new key to be first in the
chain. As the migration proceeds, and the new metadata propagates, the
best decryption key to try first (from an efficiency point of view) is
the new decryption key.

As far as the wait time is concerned, I don't disagree with anything
that Scott said. However, if you make the changes discussed above, you
can wait indefinitely without penalty, so unless you're 100% sure that
all IdPs have refreshed their metadata, there's no harm in waiting.
Keep in mind that InCommon metadata has a three-week lifetime. After
three weeks, the metadata expires and software starts to fail. So I'd
feel pretty confident that all IdPs have refreshed by then.

Tom