Metadata expiry and computing a new expiration time.

[Ian Young]

> On 14 Sep 2015, at 11:02, Ian Young <ian at iay.org.uk> wrote:
> 
>> On 14 Sep 2015, at 10:01, Simon Fraser <srf at sanger.ac.uk> wrote:
>> 
>> I've added the verification based on the example in the config file:
> 
> Not sure why that isn't working (and we should definitely try to get to the bottom of it)

Looking deeper, I note that the example in the config file is for an inline *public key*. What you have in your configuration is an embedded *certificate*. The error you're seeing is the low-level ASN.1 parser trying to parse an encoded public key and failing.

One option would be to go through the effort of extracting the UKf public key from the certificate to use in the way described in the example, but it seems like a lot of work. The UKf recommended configuration I listed in an earlier message is a better approach here.

    -- Ian




-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 5250 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/users/attachments/20150914/1e3e7088/attachment.p7s>