removing old certificate from metadata

[Izz Noland]

Understood.  Thank you again!

Izz Noland
Sr. Systems Engineer

izz.noland at wepanow.com
Toll Free 1.800.675.7639
100 Gilbert Drive | Alabaster, Alabama 35007


-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Wednesday, August 10, 2016 2:26 PM
To: Shib Users <users at shibboleth.net>
Subject: Re: removing old certificate from metadata

On 8/10/16, 3:23 PM, "users on behalf of Izz Noland" <users-bounces at shibboleth.net on behalf of izz.noland at wepanow.com> wrote:

> Unfortunately this particular shibboleth instance is not a 'native' 
> implementation.  It is OpenAM from ForgeRock and there isn't a way to 
> reference more than one key in the very old implementation we have.  I 
> did build a native environment a little over a year ago and have all 
> of our new customers since then on it, with plans to move the handful we have on openam to native shibboleth.

Appreciate the clarification, but my answer wasn't really in reference to Shibboleth SP behavior, it's still true that if you advertise an encryption key in metadata you can't decrypt with, there's nothing preventing a failure. The issue is who's consuming the metadata, not your software.

-- Scott


--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net