How do I change the certificate of a Shibboleth service provider?

[Nate Klingenstein]

Chloe,

> What is my false premise?
> Why shouldn't I change the certificate?
> What do you think I want it to mean?

I think Scott's concerned that you're crossing certificates that are  
used for front-channel communication with browser users and  
certificates that are used for encryption and signature in  
communication with IdP's.  There is no technical reason why these  
certificates need to be the same, and in fact, there are some benefits  
to making them different, most notably the short expirations of  
commercial browser-facing SSL certificates.

I think he's trying to communicate that there may be no need to change  
this certificate.  That said, in your environment, there may very well  
be one that we don't know about.

> Plus, I copied the certificate metadata directly from Shibboleth  
> itself:
> https://sp-qa-machine01/Shibboleth.sso/Metadata
>
> How do I know if the metadata is accurate? I copied and pasted the  
> relevant KeyDescriptor section, and have double and triple checked.

The metadata is likely to be fine, although I know the dynamic  
metadata generator is not recommended for anything beyond simple use  
cases.  You just need to ensure that the new certificate is there.

You may be encountering a situation where the SP is using its old  
certificate for the actual transaction even though the metadata for  
the SP contains both certificates, and the IdP only trusts the new SP  
certificate.

> How do I specify a rule in the IP to use the new certificate? Are  
> you referring to Attribute rules?

The SP can be configured to use a non-default certificate with a  
specific IdP:

https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPRelyingParty

The default is the first one listed in shibboleth2.xml.

> I did 're-order' the certificates in the metadata, because I  
> commented out the first SP certificate so only the new SP  
> certificate would be visible in the metadata.

The order in the metadata doesn't, AFAIK, matter.  If you commented  
out the first SP certificate without modifying the SP's configuration  
so that it's using the new certificate, then the behavior you  
experience is exactly what I would expect.

I'm not sure if you've yet read:

https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPMultipleCredentials 
#NativeSPMultipleCredentials-KeyRollover

Anyway, I'd try inverting the order of the CredentialResolver elements  
in your shibboleth2.xml file.  You can also look at the logs on the  
IdP to see exactly what certificate your SP is using for the  
communication if you continue to encounter problems.

Take care, and thanks for your use of Shibboleth,
Nate.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20120719/d73d7ccd/attachment.html