help signing metadata

[Cantor, Scott]

On 10/25/11 12:34 PM, "Jonathan Bricker" <jbricker at exacttarget.com> wrote:

>The original question was under the assumption that I could have nested
>signatures.  Using the Metadata filter was just a way for checking the
>certs.  All I want to do is have a way of checking the IDP certs are not
>expired or revoked.  Can that be done without the metadata filter?

It can't be done at all without writing plugins.

The purpose of metadata verification is not to check the certificates
controlled by the entity, it's to verify the integrity of the metadata
document itself. The only way to connect it to the certificates inside the
metadata is to self-sign the metadata with the same certificate. If you're
aggregating metadata, that means nested signatures.

But there's nothing there that imposes a relationship between the
certificate in the metadata and the signing certificate in that scenario;
that would be a different (non-existent) filter.

The trust model we advocate is to care nothing about the certificates in
the metadata, only what's used to sign it. Not every possible alternative
is supported without writing code.

-- Scott