IdP & LDAP source using private CA

[Peter Schober]

* David Bantz <dabantz at alaska.edu> [2013-04-15 23:07]:
> On Mon, 15 Apr 2013, at 12:44 , Peter Schober <peter.schober at univie.ac.at> wrote:
> > If you need to go through all that trouble to avoid untrustworthy
> > certificates of your own making you're Doing It Wrong. 
> 
> Neither the certs nor the private CA is of my own making of course;
> they are for the convenience of the group providing and administering
> the relevant Domain Controllers; the private CA using MS tools makes
> their internal operations much easier and more robust - so they say.

You already know how much to trust that based on their previous
actions, of course :(

> > Put that custom CA into your JVM truststore, done.
>  
> Well...done until an update or patch replaces the JVM keystore with
> a newer version of trusted CAs, yes?

a. keystore != truststore
b. What Scott said. I've never had a packaged software upgrade remove
(overwrite) my entries in the JVM truststore. If you're in charge
yourself of upgrading the JVM, well, then it's your job to make sure
your truststore doesn't get nuked.
If you fear that's going to happen install processes what monitor the
truststore for the existance of your privatre CA and either fix it or
notify you when something is off (e.g. cfengine, puppter, etc.pp.)
-peter