using a cert bundle in a TrustEngine

[Cameron Kerr]

Are you talking of the front-channel or back-channel? In our federation, the back-channel certificate is not signed by a public CA (but is instead signed by the Federation... I imagine this is likely the common way of doing this).

We're in a similar position; using a minor CA. If you have Apache fronting your IdP, then you'll need to put the CA certificates (that related to your certificate), into a file such as /etc/pki/tls/certs/idp_cacerts.pem, and then offer them using Apache, using this command:

        SSLCertificateFile /etc/pki/tls/certs/idp.crt
        SSLCertificateKeyFile /etc/pki/tls/private/idp.key
        SSLCertificateChainFile /etc/pki/tls/certs/idp_cacerts.pem

This is a standard deployment for use when using Apache with our particular CA. We didn't have to do anything particular in our IdP, I believe.

Hope that helps.

Cheers,
Cameron

From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Liam Hoekenga
Sent: Friday, 31 January 2014 3:18 p.m.
To: Shib Users
Subject: using a cert bundle in a TrustEngine

We've been given a certificate that wasn't signed by a top level CA.  We can use the certificate itself in the TrustEngine definition, but the people running the service provider thinks we need to use the certificate bundle that can verify the host certificate, through several intermediates, back up to the top level cert.

I tried to point the TrustEngine at a file that included all of the chained certs.. but that didn't do anything.

Is it possible to use chain certs to validate the host cert?

Liam

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20140131/a5034747/attachment.html