changing the dns name of the IDP

[John Morrison]

On Mon, 2016-07-11 at 13:03 +0000, Cantor, Scott wrote:
> > What's the quickest way instead of re-generating all the certs. signing,
> > encryption, backchannel to change the IdP's DNS name?
> 
> The only one that contains a name that matters is the backchannel one, so if you don't need the back channel, you probably don't need to worry about it. But uou can use any tools you want to generate keys and certificates, you shouldn't rely on the IdP to do it for you. It's essential to be fully comfortable dealing with them with whatever tools you prefer to use (e.g. OpenSSL).
> 
> -- Scott
> 
I've notice that the DNS name didn't mater in the signing and encryption
certs!  So really it's a lot of work. Probably not worth it, as who uses
backchannel these days.


How I did the backchannel. And with the others, I used the same method
just the one step with

net.shibboleth.utilities.java.support.security.SelfSignedCertificateGenerator.


java -cp "../webapp/WEB-INF/lib/*:../bin/lib/*"
net.shibboleth.utilities.java.support.security.SelfSignedCertificateGenerator --lifetime 10 --certfile idp-backchannel.crt.new --keyfile idp-backchannel.key.new --hostname weblogin.uu.se --uriAltName https://NEW.DOMAIN.NU


openssl pkcs12 -export -out idp-backchannel.p12.new -inkey
idp-backchannel.key.new -in idp-backchannel.crt.new

/John