Renewing Shibboleth Certificate

[Cantor, Scott]

On 9/12/12 10:49 AM, "Wavyne Belance" <wbelance at luc.edu> wrote:

>When the certificate in the metadata file expires, then I should not make
>changes within the relying-party file to reflect the renewed cert?

If you only have one credential and you renew the certificate then nothing
changes but replacing the file and restarting the IdP.

> 
>As you stated when you renewed the certificate, you don't have to change
>the key in the relying-party file, but the SP gets a different
>certificate than the one in the metadata if the key isn't also renewed,
>correct?

You can't renew a key, they don't have lifetimes. If your certificate
changes without the key changing, then metadata distributed to peers
should be updated. If the key changes and you don't manage the change
appropriately and deliberately, then you'll break something. It's also
likely that implementations that don't support metadata will break anyway.

>When would I need to update the key and the certificate in the
>relying-party file?

I can't answer open ended questions. The file references your credentials.
You never touch it at all unless you change the name of those files.
Whether the files themselves change depends on how you're managing trust
with partners, what they do for SAML trust management, and so on.

We use long-lived certs that are self-signed and push all of that to the
metadata, and the key and cert don't change unless there's a compromise or
an age issue requiring key rollover.

>And what certificate should be in the metadata file? The CA signed
>certificate or the server issued certificate being referenced in the
>relying-party file?

The metadata refers to keys used in SAML communication with partners. That
will certainly include the one referenced by the IdP and may include
others depending on deployment specifics. You want absolutes, but I can't
give them to you. If you can describe how your deployment works or how
it's meant to work, then it's possible to answer specific questions.

-- Scott