How do I change the certificate on an IDP web server?

[Nate Klingenstein]

Chloe,

To add to Paul's answer with a little more detail on some of your  
questions...

> I thought that since the IDP didn't care about the SP's web server  
> certificate, and it doesn't
> perform any verification other than with metadata, then the SP  
> wouldn't care about the IDP's
> web server certificate either, and would only use metadata.

The IdP, in almost all deployment situations, doesn't care about the  
certificates used by the web server that hosts the SP because that web  
server isn't directly involved in any communication with the IdP.  The  
user will interface with the web server while carrying messages from  
the IdP, but the trust comes from the signature on the assertion that  
the user is carrying.  An SSL tunnel exists between the user and the  
SP's web server when delivering that assertion, but that just provides  
a secure, private channel for that particular step.

> Why make it so that the IDP only verifies via metadata, but the SP  
> verifies by metadata AND a web server certificate?

The SP only verifies by metadata as well.  The difference is, in  
backchannel communications between the SP and the IdP, the SP presents  
its certificate directly, but the IdP's web server presents the  
certificate on the IdP's behalf.  That's because of the way each piece  
was implemented: it's easy to initiate a query from the SP using the  
CURL libraries, but challenging and uncommon for Java Servlets like  
the IdP to receive and process web queries themselves.

> How would I add the web server certificate to the IDP metadata? The  
> SP fetches the IDP's
> metadata via HTTP and saves it into a file.

You'd have to change the IdP's metadata wherever the SP is pulling it  
from.  The SP generates metadata dynamically based on its  
configuration files, but the IdP generates it once during installation  
and you need to make further changes yourself.

If you're using the built-in /idp/profile/Metadata/SAML handler, then  
you need to modify the file that it's hosting, typically $IDP_HOME/ 
metadata/idp-metadata.xml.  You'll see two certificates in there, and  
you can replace those, or add your new certificate next to each of the  
old ones.

> I see multiple
>    <security:Credential id="IdPCredential"  
> xsi:type="security:X509Filesystem">
> with different ids in relying-party.xml. Would I add the web server  
> cert/key there?

Your IdP should have one credential in most deployment situations,  
including this one.  For rollover, you'd follow this general process:

1)  Add new certificate to metadata
2)  Change Apache's SOAP port (generally 8443) configuration to use  
the new certificate in place of the old
3)  Change the IdP's relying-party.xml to use the new certificate in  
place of the old
4)  Remove old certificate from metadata

Done.

I hope between Paul's response and my own, most of your questions were  
answered.
Nate.