How do I change the certificate of a Shibboleth service provider?

[Cantor, Scott]

On 7/23/12 1:19 PM, "CHLOE SOWERS (BLOOMBERG/ 731 LEXIN)"
<csowers at bloomberg.net> wrote:

>Ok, so I think I understand. You're saying the certificate doesn't matter
>since the user never sees it. However, eventually the certificate will
>expire so we will eventually need to replace it.

It's not whether the user sees it, it's the trust management profile in
use in the software.
Shibboleth does not rely on the expiration of the certificate, that's up
to the metadata. Avoiding expired SAML certificates is a suggestion to
address limitations of other software.

>This is what happens in the log when I comment out the old cert in the
>IDP, restart, and comment out the old cert in the SP, restart, and try to
>authenticate:

That's your IdP's web server misconfigured to validate certificates
instead of skipping validation and leaving it up to the application code.
There are dozens if not hundreds of threads in the archive about it.

>And for reference, this is the entry in the IDP for <RelyingParty>,
>relying-party.xml:

IdP isn't even involved, the web server is broken before it gets control.

-- Scott