Changing the certs

[Rich Graves]

> If we change the Idp certificate, do we have to inform all the service providers about the new cert? What are the consequences of using expired cert? 

Neither shibboleth software nor InCommon care about entity certificate expiration (neither its own nor another entity's, applies to both IdP and native SP). The only purpose of the certificate is to describe the key. However, other SAML software or identity federations might care about cert expiration.

Assuming that your private key and CA (if any; usually you self-sign) stay the same, the cert change is irrelevant. However, if you intend to change your private key, you must follow a rollover procedure carefully.

See also:

https://spaces.internet2.edu/display/InCFederation/Certificate+Migration
https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPMultipleCredentials
https://www.switch.ch/aai/docs/shibboleth/SWITCH/sp-certificate-rollover.html