Cert rollover sanity check

[Mike Flynn]

Thanks, Tom.  You're not as bad as Max says after all :D



________________________________
From: Tom Scavo <trscavo at gmail.com>
To: Shib Users <users at shibboleth.net>
Sent: Friday, October 21, 2011 8:42 AM
Subject: Re: Cert rollover sanity check

On Fri, Oct 21, 2011 at 10:56 AM, Mike Flynn <shibbolethlynda at yahoo.com> wrote:
> ... my step 2 will look like this:
>         Change old setting FROM:
>
>          <!-- Your SP generated these credentials.  They're used to talk to
> IdP's. -->
>          <CredentialResolver type="File" key="sp-key.pem"
> certificate="sp-cert.pem"/>
>
>         TO:
>
>         <CredentialResolver type="Chaining">
>         <!--
>              Certificate/Private key pairs are read in sequence.
>              Unless specificially defined only the first
>              CredentialResolver is used for attribute requests.
>         -->
>               <CredentialResolver type="File" keyName="Standby"
> use="encryption"
>
> key="C:\opt\shibboleth-sp\etc\shibboleth\sp-key-2011.pem"
>
> certificate="C:\opt\shibboleth-sp\etc\shibboleth\sp-cert-2011.pem"/>
>              <CredentialResolver type="File" keyName="Active"
>
> key="C:\opt\shibboleth-sp\etc\shibboleth\sp-key.pem"
>
> certificate="C:\opt\shibboleth-sp\etc\shibboleth\sp-cert.pem"/>
>         </CredentialResolver>
>
> That about right?

Yup!

Good luck,
Tom
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20111021/572b5ccd/attachment-0001.html