Renewing certificates on windows installation

[Morris, Andi]

Thanks Peter. I'll do some scratching around with all the individual components' configs then.

Andi

-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Peter Schober
Sent: 01 March 2013 12:17
To: users at shibboleth.net
Subject: Re: Renewing certificates on windows installation

Andi,

Sadly none of your questions are really specific for this list.
I'll add a few generic comments below but generally this is not the best place to ask, even if you intend to run the Shibboleth software somewhere in your stack.

* Morris, Andi <amorris at cardiffmet.ac.uk> [2013-03-01 12:52]:
> My idp certificates are coming up for a renewal in the next month and
> I have a few questions regarding how to go about this if anyone can
> point me in the right direction? I also have a question regarding
> updating components on the IDP server.

Note that use of TLS/SSL certificates with the Apache httpd (if you're using that; not clear from what you wrote) or the Apache Tomcat webserver each have their own place and documentetion elsewhere:
http://httpd.apache.org/docs/2.2/en/ssl/

http://tomcat.apache.org/tomcat-6.0-doc/ssl-howto.html
or
http://tomcat.apache.org/tomcat-6.0-doc/apr.html#HTTPS
if you're using "Apache Portable Runtime (APR) based Native library for Tomcat", which can use base6-encoded .pem files for TLS/SSL.

> 1 - My installation is a Windows based one, but the installed
> certificates are Apache based. Do I just use a linux server somewhere
> to generate the new certificate request file and then export the
> corresponding private key from that once the request has been
> completed, or is there a way to generate apache cert requests from
> within the Windows install?

First and formost you should clearly state what software or server process is handling TLS/SSL. The OS is some form of MS-Windows, OK.
What is the webserver used? Apache httpd? Apache Tomcat solo? Your ISA applicance, as stated below?

> 2- I publish the idp server through an ISA server, which requires IIS
> style certificates. Can I just use IIS certificates with the same
> friendly name on the ISA server and point them to port 443 on the idp
> server?

I couldn't say. Whatever process or appliance handles end users' HTTPS traffic should have a valid certificate (and even that isn't a requirement from the Shibboleth software, only from common sense).
How that gets there and which tools you use to generate it and put it there is completely up to you (and your setup unknown to me).

> 3 - With the recent concern regarding Java I'm concerned about leaving
> my Java install unpatched, however whenever I run the upgrade on the
> java software my IDP server won't start (from memory it's the tomcat
> service that won't start). I've looked inside the various Tomcat
> configs but I can't see anything that seems to tie it to an exact
> version number, do I need to do something funky inside to Tomcat to
> get it to recognise the updated java install? The paths declared in
> the Environment variables remains the same.

This list also is not the best list for generic Java & Tomcat questions.
Also none of what you say is nearly specific enough for any concrete advise. When Tomcat does not start there's a log file detailing the reason. Tomcat comes with wrapper scripts that point at a JVM (but how Tomcat is started in your environment i have no idea). If you want Tomcat to use another JVM you'll probably need to tell it somewhere.

Sorry,
-peter
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
________________________________

From 1st November 2011 UWIC changed its title to Cardiff Metropolitan University. From the 6th December 2011, as part of this change, all email addresses which included @uwic.ac.uk have changed to @cardiffmet.ac.uk. All emails sent from Cardiff Metropolitan University will now be sent from the new @cardiffmet.ac.uk address. Please could you ensure that all of your contact records and databases are updated to reflect this change. Further information can be found on the website here.<http://www3.uwic.ac.uk/English/News/Pages/UWIC-Name-Change.aspx>

Ar Dachwedd y 1af 2011 newidiodd UWIC ei henw i Brifysgol Fetropolitan Caerdydd. O Ragfyr 6ed, fel rhan o'r newid yma, bydd pob cyfeiriad e-bost sy'n cynnwys @uwic.ac.uk yn newid i @cardiffmet.ac.uk. Bydd yr holl ebyst a ddanfonir o Brifysgol Fetropolitan Caerdydd yn cael eu danfon o‘r cyfeiriad @cardiffmet.ac.uk newydd. Gwnewch yn siwr eich bod yn diweddaru eich cofnodion cyswllt a'ch cronfeydd data i adlewyrchu hyn. Gellir cael rhagor o wybodaeth ar y wefan yma.<http://www3.uwic.ac.uk/English/News/Pages/UWIC-Name-Change.aspx>