Cert rollover sanity check

[Mike Flynn]

OK, I have made all of my changes on the SP side and am now ready to get the new cert published in the InCommon Metadata.

The instructions say that when I add my cert to InCommon I need to add it with no use= XML attrib.  But in the dropdown I have Signing only and Signing and Encryption.  Which of these should be selected for both the NEW and the OLD certs?



________________________________
From: Mike Flynn <shibbolethlynda at yahoo.com>
To: Shib Users <users at shibboleth.net>
Sent: Friday, October 21, 2011 9:22 AM
Subject: Re: Cert rollover sanity check


Thanks, Tom.  You're not as bad as Max says after all :D


________________________________
From: Tom Scavo <trscavo at gmail.com>
To: Shib Users <users at shibboleth.net>
Sent: Friday, October 21, 2011 8:42 AM
Subject: Re: Cert rollover sanity check

On Fri, Oct 21, 2011 at 10:56 AM, Mike Flynn <shibbolethlynda at yahoo.com> wrote:
> ... my step 2 will look like this:
>         Change old setting FROM:
>
>          <!-- Your SP generated these credentials.  They're used to talk to
> IdP's. -->
>          <CredentialResolver type="File" key="sp-key.pem"
> certificate="sp-cert.pem"/>
>
>         TO:
>
>         <CredentialResolver type="Chaining">
>         <!--
>              Certificate/Private key pairs are read in sequence.
>
              Unless specificially defined only the first
>              CredentialResolver is used for attribute requests.
>         -->
>               <CredentialResolver type="File" keyName="Standby"
> use="encryption"
>
> key="C:\opt\shibboleth-sp\etc\shibboleth\sp-key-2011.pem"
>
> certificate="C:\opt\shibboleth-sp\etc\shibboleth\sp-cert-2011.pem"/>
>              <CredentialResolver type="File" keyName="Active"
>
> key="C:\opt\shibboleth-sp\etc\shibboleth\sp-key.pem"
>
> certificate="C:\opt\shibboleth-sp\etc\shibboleth\sp-cert.pem"/>
>        
 </CredentialResolver>
>
> That about right?

Yup!

Good luck,
Tom
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net



--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20111031/7f7deca1/attachment.html