SHA-1 Certificate in Metadata

[Peter Schober]

* kripp <kripp at compsych.com> [2014-10-30 14:58]:
> we're wondering if Google Chrome sunsetting sha-1 will affect the
> current metadata files that we have provided to our users or if
> those need to be updated to no longer use sha-1 also?

Web browsers use certificates to secure conections to web servers
(TLS). They don't access SAML metadata and they wouldn't know what to
do with it (such as parsing the XML and performing checks on certain
parts of the XML).
But if you're using the same key for web server TLS and the SAML trust
fabric that question really is pointless: If you wanted to continue
using the same key pair (for which no good reasons exist) you'd have
to change the keys in SAML metadata when you changed the TLS key.

Short version: Don't do that. Use seperate key pairs and forget about
changing the keys embedded in SAML metadata until you change your mind
about it, not as soon as your web server TLS certificate needs to be
changed.
-peter