Renewing Shibboleth Certificate

[Wavyne Belance]

Hello Scott 
 
Thanks for your explanation. I have a few follow-up questions:
 
When the certificate in the metadata file expires, then I should not make changes within the relying-party file to reflect the renewed cert?
 
As you stated when you renewed the certificate, you don't have to change the key in the relying-party file, but the SP gets a different certificate than the one in the metadata if the key isn't also renewed, correct?
 
When would I need to update the key and the certificate in the relying-party file?
 
And what certificate should be in the metadata file? The CA signed certificate or the server issued certificate being referenced in the relying-party file?
 
Thanks again
Wavyne Belance

>>> "Cantor, Scott" <cantor.2 at osu.edu> 9/11/2012 8:52 AM >>>
On 9/11/12 7:29 AM, "Wavyne Belance" <wbelance at luc.edu> wrote:
>
>The certificate is updated in my metadata and its location and  the key
>are in the relying-party.xml file. I also see the saml2 assertion being
>sent with the correct certificate when I turn debugging on. Where did I
>go wrong?

You're using the wrong key, the metadata's wrong, or the SP doesn't have
the metadata you think it does.

>Are there step by step guides to renewing the Shibboleth certificate?

Several. But renewing a certificate is mostly irrelevant and won't cause
this error. Changing a key is the only time it matters. Renewal does not
involve changing a key.

If you really changed the key, then you would need to follow something
along the lines of 
https://wiki.shibboleth.net/confluence/display/SHIB2/IdPKeyRollover

-- Scott


--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20120912/e3904e45/attachment.html