IdP failed to retrive metada (problem, possible solution, and good practice): javax.net.ssl.SSLPeerUnverifiedException: SSL peer failed hostname validation for name: null

[Peter Schober]

* Christian Munive <christian.munive at gmail.com> [2014-07-25 00:12]:
> Thanks Scott. I'll stick to http for the metadata.

And you'll need to sign that metadata. Otherwise you'd just be passing
around plain text files (containing cryptographic keys and protocol
endpoints) saying "trust this information", without any security involved.
(Basically "web of trust" without any "web")

At one point you'll want to use a metadata aggregator for your newly
built federation, and that can do all the signing for you, too.
So maybe check out the Shib MDA (examples here[1]) or pyFF[2] and
distribute signed metadata from the beginning.

For simpler tasks samlsign[3] from the SP distribution or the
contributed XmlSecTool[4] will also allow to sign SAML metadata rather
easily.

As for the key to sign with, best to ask on the REFEDS (or REFEDS FOG)
mailing list.
-peter

[1] http://edugain.org/technical/metadata_processing.php
[2] https://leifj.github.io/pyFF/
[3] https://wiki.shibboleth.net/confluence/display/OpenSAML/OSTwoUsrManCPPsamlsign
[4] https://wiki.shibboleth.net/confluence/display/SHIB2/XmlSecTool