Invalid OpenSSL traditional private key format IDP3.x

[Cantor, Scott]

On 8/12/16 10:56 AM, Shweta Kautia wrote:
> 
> We have an old IDP 2.x, with an old cert.
> When moving to new IDP 3.x,
> the old cert gives the following error.

No, it doesn't, the error is coming from the private key. If you don't
understand the difference, please stop and read up on that because it
matters a great deal.

> However, new generated pair of
> key/cert seems to work fine. Does this mean we will have to use the new
> one, or is it possible to keep the old cert and make it work with IDP
> 3.x with different settings etc? 

This is not about the certificate. If it were, generating a new one with
the same key would be a possible workaround.

As it is you would have to change the key, but unless you have about 5
SPs, all that you control, it is a non-starter to even think about
changing the key.

Somebody else might know what the error means, but I do not offhand.
What I would probably look at doing is to try and move the key into and
out of some other formats to try and get it into a format the IdP will load.

You cannot post the key, so I'm loathe to even ask, but it would
probably help to know what the header/footer in the key file might be,
if it's in text format. If it's in a binary format, then moving it into
a standard text format would be a step to try.

You'll need to read up on openssl commands most likely and play with
them to try and get the key into a more standard form.

It didn't come from us, I can tell you that much. Anything we would have
generated during an IdP install would work.

DO NOT SEND THE KEY ANYWHERE TO ANYBODY. If that's already understood,
please don't be offended, but once you do that, it's game over.

-- Scott