SP trust fabric certificate expiring

[Peter Schober]

Scott,

That should probably go to the REFEDS mailing list <refeds at terena.org>.

* Scott Klawitter <sklawitter at ebsco.com> [2012-06-22 20:02]:
> In our research to renew the cert, we have noticed that many
> federations have changed their acceptance policies regarding the
> trust fabric certificate for the SP metadata. Some federations like
> the UKfederation ARE NOT ACCEPTING VeriSign CERTIFICATES ANYMORE and
> recommend using a self-signed cert.
> 
> I wanted to see if there is a generally acceptable certificate that
> federations will accept, or is the self-signed cert the right
> one. Also is there a generally acceptable lifetime for the cert? 5,
> 10, 20 years?

Unless you find a federation that does /not/ accept a self-signed
certificate embedded in metadata doing that is the right approach.
(Even then an exception for any IOP[1] outliers could be made.)

As for years this will depend on your own policies and risk
assessment. The IOP[1] and from that the widely used
https://saml2int.org/ does /not/ require certs to be valid (but
RECOMMENDS them to be) for the public keys to be considered valid.
-peter

[1] https://wiki.oasis-open.org/security/SAML2MetadataIOP