removing old certificate from metadata

[Cantor, Scott]

On 8/10/16, 3:23 PM, "users on behalf of Izz Noland" <users-bounces at shibboleth.net on behalf of izz.noland at wepanow.com> wrote:

> Unfortunately this particular shibboleth instance is not a 'native' implementation.  It is
> OpenAM from ForgeRock and there isn't a way to reference more than one key in the very old
> implementation we have.  I did build a native environment a little over a year ago and
> have all of our new customers since then on it, with plans to move the handful we have on
> openam to native shibboleth.

Appreciate the clarification, but my answer wasn't really in reference to Shibboleth SP behavior, it's still true that if you advertise an encryption key in metadata you can't decrypt with, there's nothing preventing a failure. The issue is who's consuming the metadata, not your software.

-- Scott