OpenSSL advisory

[Peter Schober]

* Cantor, Scott <cantor.2 at osu.edu> [2015-07-09 17:50]:
> I would strongly suggest people consider turning PKIX off in the SP in shibboleth2.xml:
> 
> ...metadata providers...
> 
> <TrustEngine type="ExplicitKey" />
> 
> ...attribute extractors, etc....

The current default config ships with no TrustEngine elements defined,
and the documentation doesn't state the default behaviour in case zero
TrustEngine elements occur:
https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPApplication#NativeSPApplication-ChildElements
So how to turn it off then?
-peter