AW: Shibboleth SSL certificate

[Support]

I did exactly this mistake to replace it in the meta data. What ist the best way to undo it?
The block <X509Certificate> in the metadata file ist the  public key in pem format, isn't it? What is it exactly uses for and where ist the matching private key for?

-----Ursprüngliche Nachricht-----
Von: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] Im Auftrag von Peter Schober
Gesendet: Donnerstag, 28. November 2013 11:58
An: users at shibboleth.net
Betreff: Re: Shibboleth SSL certificate

* Gianluigi Ruggeri <gianluigi83 at gmail.com> [2013-11-28 11:49]:
> I have my apache webserver configurated with AJP connector to my Tomcat.
> So, I already have a SSL certificate (configurated in my Apache web server).
> Now, when I install my shibboleth Idp is generated a new certificate
> (I see /credentials idp.crt idp.key, idp.jks).
> I see the certificate (encoded) into my metdatafile.
> Is possibile to use my original certificate? How can I change the
> configuration?

It is possible but it is strongly advised NOT to do this.
Certificates (or just keys) to encrypt and sign SAML protocol messages are not generally used to terminate TLS/SSL connections and never are seen from an end user's web browser.
As such using commercial CA-issued certificates for securing SAML protocol messages buys you exactly nothing, but given their short liftime forces you into (unnecessary) renewals based on someone else's business model (not your own security considerations and time scale).
-peter
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net