Cert rollover gone bad

[Tom Scavo]

On Sat, Jun 4, 2016 at 3:02 AM, Izz Noland <izz.noland at wepanow.com> wrote:
>
> Earlier today I updated InCommon metadata with a second certificate as ours
> is about to expire and it needed to be rekeyed anyway. Once the metadata was
> published, school IdPs failed to authenticate to our SP with a 500 error.
> We went ahead and swapped the keys out in shibboleth and this fixed most
> schools.

It's water under the bridge but for the archives you did that
backwards. First you configure your SP with a second key and *then*
you introduce a new certificate into metadata.

NativeSPMultipleCredentials: https://wiki.shibboleth.net/confluence/x/KIFC
SP Cert Migration: https://spaces.internet2.edu/x/dpiKAQ

> We still have one that is failing (after the metadata publication,
> both before and after changing our cert/key on the SP) with the following
> error in the logs:
> ERROR: spAssertionConsumer.jsp: SSO failed.
> com.sun.identity.saml2.common.SAML2Exception: Failed to decrypt the secret
> key.

Did you configure two decryption keys in your SP? My guess is the IdP
used a encryption certificate in metadata that doesn't have a
corresponding decryption key in the SP software.

Tom