removing old certificate from metadata

[Izz Noland]

Scott:
Unfortunately this particular shibboleth instance is not a 'native' implementation.  It is OpenAM from ForgeRock and there isn't a way to reference more than one key in the very old implementation we have.  I did build a native environment a little over a year ago and have all of our new customers since then on it, with plans to move the handful we have on openam to native shibboleth.

Good to know about not leaving it there.  That's pretty much what my thoughts were, but wanted assurance. :)

Thanks Nate  and Scott.

Izz Noland
Sr. Systems Engineer

izz.noland at wepanow.com
Toll Free 1.800.675.7639
100 Gilbert Drive | Alabaster, Alabama 35007

-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Wednesday, August 10, 2016 1:56 PM
To: Shib Users <users at shibboleth.net>
Subject: RE: removing old certificate from metadata

> Our metadata currently has two certificates.

For two different purposes that have fundamentally different properties. If you don't understand signing and encryption, you need to start with that understanding to get to the point where you can manage keys safely.

> I want to remove one that is
> about to expire.  It is not referenced any longer in our SP 
> configuration, and IdPs haven't had any issues since we were able to 
> recover from a mistake made in the cert rollover in June.  Anyone see 
> any issue with either of the
> following:
> 
> 1.      Just removing the old certificate from the metadata with InCommon

You can't break anything by removing a key from metadata that is no longer referenced in your configuration and isn't going to be added back. That at least is a given. You *can* break things by leaving an encryption key in metadata that is not in your configuration, so you are getting lucky now.

> 2.      Leaving the certificate which is about to expire, since it isn't used

Any key in metadata MAY be selected by an IdP for encryption. So you are getting lucky if it's working simply because IdPs mostly pick the first one.

> a.       For informational purposes.  Are there cases where configs would
> reject metadata if an expired certificate is in it, although no longer utilized?

Reject metadata? Unlikely.

In a nutshell, get your key out NOW. You're risking a broken login by any IdP that picks the key you no longer have loaded.

-- Scott


--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net