removing old certificate from metadata

[Cantor, Scott]

> Our metadata currently has two certificates.

For two different purposes that have fundamentally different properties. If you don't understand signing and encryption, you need to start with that understanding to get to the point where you can manage keys safely.

> I want to remove one that is
> about to expire.  It is not referenced any longer in our SP configuration, and
> IdPs haven't had any issues since we were able to recover from a mistake
> made in the cert rollover in June.  Anyone see any issue with either of the
> following:
> 
> 1.      Just removing the old certificate from the metadata with InCommon

You can't break anything by removing a key from metadata that is no longer referenced in your configuration and isn't going to be added back. That at least is a given. You *can* break things by leaving an encryption key in metadata that is not in your configuration, so you are getting lucky now.

> 2.      Leaving the certificate which is about to expire, since it isn't used

Any key in metadata MAY be selected by an IdP for encryption. So you are getting lucky if it's working simply because IdPs mostly pick the first one.

> a.       For informational purposes.  Are there cases where configs would
> reject metadata if an expired certificate is in it, although no longer utilized?

Reject metadata? Unlikely.

In a nutshell, get your key out NOW. You're risking a broken login by any IdP that picks the key you no longer have loaded.

-- Scott