509 Certificate in Idp-sp communication

[Rod Widdowson]

> our certificate which is placed in idp-metadata.xml. I think we do not need to
> upgrade shibboleth-idp.jar for this.

I think that was already answered.  Java doesn't use OpenSSL.  OpenSSL vulnerabilities will not affect java programs.  

> I can able to see only the <ds:X:509 Certificate> certificate in the idp-metadata.xml except that i don't see any other keys(pvt key) in credentials folder

No idp.key file?  Just the idp.crt file (with similar content to the metadata statement).

What does relying-party.xml have to say about your credentials.  Look for a line like this

    <security:Credential id="IdPCredential" xsi:type="security:X509Filesystem">

That explicitly sets where the key and crt file are being served from.