SP metadata that supports both sha1 and sha2?

[Cantor, Scott]

> My impression is that they're planning on rolling out a new signing cert as
> part of their move to sha256.

No, they're rolling out a new encryption key, or they changed the certificate around the same key for no reason. Either way, this isn't how you do a migration, and they're confused regardless because this isn't anything needed to do a migration to SHA-2.

>     ...we still need to know if you were able to get SHA256 support
>     working in a way that allows you to have both certs available, so that
> there’s
>     no outage incurred when we switch the encryption certificate on our side
> to
>     SHA256...

They can't do that by giving people two metadata files, and they can't do it *period* with metadata alone. The only way to safely migrate an encryption key without a flag day event is documented in our wiki, and it  absolutely requires support from the implementation of the receipient to handle it, by configuring both keys in an SP and ensuring that both will work for a period of time. It cannot be done with new metadata and the sender making a change alone, because if they only support one decryption key, that switch would have to be simultaneous.

So you'd have to know if they:

a) changed the key for real or just changed the cert (I think you were looking at the modulus I guess, so that impies they did change the key)

b) if they can support two encryption keys at once so that you can switch to the new metadata and key before they remove support for the old key, so it transitions seamlessly

Otherwise you have an outage coming.

-- Scott