How do I change the certificate of a Shibboleth service provider?

[CHLOE SOWERS (BLOOMBERG/ 731 LEXIN)]

Ok, so I think I understand. You're saying the certificate doesn't matter since the user never sees it. However, eventually the certificate will expire so we will eventually need to replace it.

I've already tried to switch the <CredentialResolver> too, and that did not work either. Here is the updated  shibboleth2.xml for the SP:

        <!--CredentialResolver keyName="Active" type="File" key="D:/Packages/Apache2.2/certs/cms.key" certificate="D:/Packages/Apache2.2/certs/cms.crt"/-->
        <CredentialResolver keyName="Active" type="File" key="D:/tmp/sp-key-qa.pem" certificate="D:/tmp/sp-cert-qa.pem"/>


This is what happens in the log when I comment out the old cert in the IDP, restart, and comment out the old cert in the SP, restart, and try to authenticate:


<-1>[shibd] DEBUG [[1]] XMLTooling.libcurl - SSLv3, TLS alert, Server hello (2):

<-1>[shibd] DEBUG [[1]] XMLTooling.libcurl - error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca

<-1>[shibd] DEBUG [[1]] XMLTooling.libcurl - Closing connection #0

<-5>[shibd] ERROR [[1]] Shibboleth.ArtifactResolver - exception resolving SAML 2.0 artifact: CURLSOAPTransport failed while contacting SOAP endpoint (https://sso.dev.company.com/idp/profile/SAML2/SOAP/ArtifactResolution): error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca

<-5>[apache-shibd] ERROR [[13076] shib_handler] Shibboleth.Listener - remoted message returned an error: Unable to resolve artifact(s) into a SAML response.

<-5>[apache-shibd] ERROR [[13076] shib_handler] Shibboleth.Apache - Unable to resolve artifact(s) into a SAML response.

<-5>[apache-shibd] ERROR [[13076] shib_handler] Shibboleth.ServiceProvider - sendError could not process error template ()

<13>Jul 23 12:36:11 MACHINE01 [apache-error]: [Mon Jul 23 12:36:11 2012] [error] [client 172.17.87.26] Unable to resolve artifact(s) into a SAML response.
<13>Jul 23 12:36:11 MACHINE01 [apache-access]: 172.17.99.99 - - [23/Jul/2012:12:36:11 -0400] "GET /Shibboleth.sso/SAML2/Artifact?SAMLart=AAQAAilRUvukmNDw%2FD8AieE4yB8yYju66OZhfVac6oADqu61zhHyZXzMC8g%3D&RelayState=ss%3Amc%3A30001c1c4e248323771b195c2645cf5b HTTP/1.1" 62507 500 61 "-" "Mozilla/5.0 (Windows NT 5.1) AppleWebKit/535.19 (KHTML, like Gecko) Chrome/18.0.1025.151 Safari/535.19"


And for reference, this is the entry in the IDP for <RelyingParty>, relying-party.xml:

    <rp:AnonymousRelyingParty provider="urn:company:sso:idp"
                           defaultSigningCredentialRef="IdPCredential" />

    <rp:DefaultRelyingParty provider="urn:company:sso:idp"
                         defaultSigningCredentialRef="IdPCredential">

        <rp:ProfileConfiguration xsi:type="saml:SAML2SSOProfile"
                              includeAttributeStatement="true"
                              assertionLifetime="PT5M"
                              assertionProxyCount="0"
                              signResponses="never"
                              signAssertions="always"
                              encryptAssertions="conditional"
                              encryptNameIds="never" />
        <rp:ProfileConfiguration xsi:type="saml:SAML2AttributeQueryProfile"
                              assertionLifetime="PT5M"
                              assertionProxyCount="0"
                              signResponses="conditional"
                              signAssertions="never"
                              encryptAssertions="conditional"
                              encryptNameIds="never" />

        <rp:ProfileConfiguration xsi:type="saml:SAML2ArtifactResolutionProfile"
                              signResponses="never"
                              signAssertions="always"
                              encryptAssertions="conditional"
                              encryptNameIds="never"/>

    </rp:DefaultRelyingParty>

    <rp:RelyingParty id="urn:company:blnc" provider="urn:company:sso"
    ...

        <metadata:MetadataProvider id="CMSMd" xsi:type="metadata:ResourceBacked$
            <metadata:MetadataResource xsi:type="resource:FilesystemResource" f$
        </metadata:MetadataProvider>

I pretty much did what was described on this link, except I manually modified the metatdata on the IDP so didn't have to wait for propogation, and I didn't use a type="Chaining".

https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPMultipleCredentials#NativeSPMultipleCredentials-KeyRollover