Invalid OpenSSL traditional private key format IDP3.x

[Cantor, Scott]

On 8/12/16 2:44 PM, Shweta Kautia wrote:
> 
> Yes there was a password used to encrypt.

That's not going to work with a new install until you set the password
into credentials.xml in the factory bean. Or add it to a property, and
embed the reference to the property as the password value in the Spring
file. Either way.

Whether that would cause that error message I couldn't say, but it's
certainly possible that it's trying to decode the encrypted file and
failing, so it wouldn't be a surprise.

> Unfortunately, we had to do a from-scratch implementation

No, you really didn't. Not unless you don't have the V2 install
available, but you have the key, so clearly that's not the case.

> We are doing a Dockerized IdP installation for our campuses, so we
> decided to do a clean install.

That doesn't follow, they don't really have anything to do with each other.

> Can you please point me to any documentation of config changes required
> for from-scratch installation to support a password-protected key? I
> will communicate this to the Sys Admin who is setting it up. I am
> reading some info here, but not on how to change the IDP setup.

credentials.xml

https://wiki.shibboleth.net/confluence/x/iYBYAQ

privateKeyPassword property on the factory bean(s).

> We used the same keypair for signing and encryption.. and plan to do the
> same for V3(if possible). 

V2 didn't have decryption implemented so there was no encryption key
before and you could not have been using the same keypair for both as a
result (both didn't exist).

-- Scott