Java 8u72 / MD5 certificates

[Brent Putman]

On 1/25/16 12:34 PM, Cantor, Scott wrote:
>> Would this affect the IdP code itself, or is it limited to
>> container-based validation?
>>
>> (i.e. is it relevant if you're fronting your container with Apache?)
> I know it doesn't affect encryption and I don't think it would affect signing unless PKIX path validation was involved, but I don't know for certain.

Yes, on the IdP side, it would current affect signing if you are using
a PKIX trust engine, but AFAIK not the more common and default explicit
trust engine.

Also: If you have any web server (Apache/Tomcat/Jetty/etc) with an MD5
cert and you have a newer Java client connecting to it, that would be
an issue.  Right now that could happen if an IdP HTTP metadata provider
connected to such an HTTPS metadata source and regular Java PKIX
processing is in effect.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160126/a6f94a4d/attachment-0001.html>