renewing IDP certificate

[Cantor, Scott]

> I deployed Shib IDP and while installing it, it created an x509 certificate for
> signing and encryption. This certificate was for DESKTOP-434 which was the
> name of my machine. I changed the name of my computer and changed the
> identity id of my IDP.

Your entityID should never change and should never be based on a physical detail of the installation. What is inside the certificates used for anything but TLS do not matter, apart from the key itself.

The installer is not geared to give you a production-ready system when you run it blindly and just take the defaults. It simply can't know what the entityID ought to be for an organization in order to be stable.

> But the certificate still has the old name which results in
> error at the SP side as it complains about recognizing the security of the IDP

No, that's simply not true. That is not why it's failing, not unless you're talking about a backchannel/SOAP situation involving TLS.

> how can i update the x509 certificate after changing the identity id of my idp?

Many tools can be used to generate keys and certificates. The primitive command line tool provided is run by the keygen script in bin/ but openssl is much more capable a tool. Regardless, you probably don't need to do this anyway. What you need are keys you understand how to use and manage and keep safe and not change.

-- Scott