How do I change the certificate of a Shibboleth service provider?

[Cantor, Scott]

On 7/19/12 12:45 PM, "CHLOE SOWERS (BLOOMBERG/ 731 LEXIN)"
<csowers at bloomberg.net> wrote:

>I would have, but Stackoverflow provides nice formatting which would have
>made the question very difficult to read in a plain text email list, and
>a messy post is not polite to anyone.

I prefer plain text, so I guess that's my bias.

>What is my false premise?

That the signer of the certificate matters.

> 
>Why shouldn't I change the certificate?

Lots of reasons. There is ample historical evidence that relying on
commercial certificates for anything SAML related is a mess, but it's
particularly a mess when you mix metaphors and trust models between
explicit keying and PKIX approaches. This happens with some frequency when
you have mixed deployments of Shibboleth and other implementations, and
usually that's where the demand for Verisign comes in.

> 
>What do you think I want it to mean?

Presumably something that pertains to the certificate itself. Shibboleth
relies on explicitly defined profiles of metadata. If you put a
certificate in metadata, it means something. It doesn't mean the same
thing to other products (which in fact don't define what it means).

>How do I tell if my SP is not using the certificate? It certainly appears
>as though the SP is using it. I have multiple credential resolvers:

That's the problem. If you have more than one, then any default scenario
means it's using the first one that's reasonable.

>        <CredentialResolver keyName="Active" type="File"
>key="D:/Packages/Apache2.2/certs/cms.key"
>certificate="D:/Packages/Apache2.2/certs/cms.crt"/> <!-- old cert -->
>        <CredentialResolver keyName="Standby" type="File"
>key="D:/tmp/sp-key-qa.pem" certificate="D:/tmp/sp-cert-qa.pem"/> <!-- new
>cert -->

Right. So the second one is totally ignored except for decryption or for
any peer in which there's a relying party rule specifying the special key
name. Absent that, for authentication and signing, it's unused.

>Plus, I copied the certificate metadata directly from Shibboleth itself:
>https://sp-qa-machine01/Shibboleth.sso/Metadata

Listing multiple keys in metadata has nothing to do with selection of
credentials use. It just means any peer consuming the metadata should
accept either key.

>How do I specify a rule in the IP to use the new certificate? Are you
>referring to Attribute rules?

If you want the certificate to be used for some IdP, it either has to come
first, or you need a RelyingParty element. This is documented in the
NativeSPMultipleCredentials topic.

>I did 're-order' the certificates in the metadata, because I commented
>out the first SP certificate so only the new SP certificate would be
>visible in the metadata.

The order in the metadata doesn't matter, at least not in terms of
verifying an authentication key.

-- Scott