help signing metadata

[Jonathan Bricker]

I want to check that the certificates are good ( i.e. not expired or revoked) and from a list of acceptable CA certs.  I'm trying to find out how to do that.  Checking signatures seems way to do it rather than checking certs at runtime.  




-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Tuesday, October 25, 2011 10:43 AM
To: users at shibboleth.net
Subject: Re: help signing metadata

On 10/25/11 10:33 AM, "Jonathan Bricker" <jbricker at exacttarget.com> wrote:

>How would I have to set up the SP to accept metadata signed from a list
>of accepted CAs?  It sounds like it is impossible from what was said
>below.

A list of static CAs is specified using a StaticPKIX trust engine with a
chain of credential resolvers pointing to the CAs, but there is no way
until 2.5 to specify the name of a signing certificate if a group of
entities is being signed.

But using a list of CAs has nothing to do with nested signatures or
multiple signers. You're going to have to be more explicit about what
you're trying to accomplish.

-- Scott

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net