SP Metadata Cert Expiration

[Tom Scavo]

On Wed, Aug 3, 2016 at 3:46 PM, Craig Pluchinsky <craigp at iup.edu> wrote:
> When a cert in metadata expires does this break anything?  IE do requests
> from the SP stop working.  We have a vendor that is using a commercial cert
> in metadata and it is set to expire in a few years.  Just want to verify
> this as a reason not to use the commercial cert in metadata and tell them to
> change.

If you're an IdP running Shibboleth, then no, an expired cert in SP
will not affect you. That said, try to convince your SP partners to
use long-lived, self-signed certs in metadata so that they don't
stumble head-first into a situation and drag you along for the ride.

AFAIK, the only software that really cares about expired certs is AD FS.

Tom