SP is not accepting the certificate of the IDP

[Peter Schober]

* Yasser Afifi <yasser at 3dissue.com> [2016-01-29 11:09]:
> My SP was working fine with my IDP, then i deployed them on an Ubuntu test
> server. IDP created a certificate while being installed that had the
> hostname in it. I then changed my DNS name but the certificate is still
> issued to old hostname. But this makes the SP not accepting the assertion
> from the IDP.

If the SP is Shibboleth then that's not what happens.
The only place the hostname inside the IDP's cert comes into play is
during backchannel/SOAP requests (such as attribtue queries) and you
shouldn't need those.

> How can I solve this? How can i make the IDP create a new certificate for
> the new hostname?

Try the documentation.

> I tried using the keygen tool and supplied --hostname myHostName but it
> doesn't create new certificates!
> 
> the error i get is Unable to establish security of incoming assertion

That's not the error during certificate creation, though.
If you change the keys on the IDP (which you shouldn't have done in
the first place) you'll also have to supply them to everyone your IDP
fderates with. I.e., you'll need to supply updated SAML Metadata to
the SAML SP.

> I got this same problem before on windows and i changed the hostname and
> reinstalled shibboleth idp and it generated certificates for the new name
> and the problem was solved. But i can't really do that on Ubuntu server!

The software doesn't know or care whether it runs on MS-Windows or on
Unix, it's a Java servlet. So that wouldn't account for any of the
differences you observe.
-peter