Cert rollover gone bad

[Izz Noland]

Yeah, I found the link afterwards and saw the problem about introducing the new key to the SP first.
As for other keys in which the one IdP is still having issues, after "fixing" auth with the others and getting the key imported on our SP, I removed the old key pair, so there's only one left in the keystore. I was hoping this would resolve the issue with that IdP, but didn't. I'll have to troubleshoot Monday with them once they're available, but I began thinking that it's possible their IdP was using one cert, and with OpenAM only allowing you to specify a single pair, something in the assertion is wrong coming across (mixed usage of both certs?)...
Thanks for the reply. Luckily this won't need to be done again for 10 years. :)

Cheers,
Izz


--
Izz
Sent using Android™



-------- Original message --------
From: Tom Scavo
Date:06/04/2016 9:24 AM (GMT-06:00)
To: Shib Users
Subject: Re: Cert rollover gone bad

On Sat, Jun 4, 2016 at 3:02 AM, Izz Noland <izz.noland at wepanow.com> wrote:
>
> Earlier today I updated InCommon metadata with a second certificate as ours
> is about to expire and it needed to be rekeyed anyway. Once the metadata was
> published, school IdPs failed to authenticate to our SP with a 500 error.
> We went ahead and swapped the keys out in shibboleth and this fixed most
> schools.

It's water under the bridge but for the archives you did that
backwards. First you configure your SP with a second key and *then*
you introduce a new certificate into metadata.

NativeSPMultipleCredentials: https://wiki.shibboleth.net/confluence/x/KIFC
SP Cert Migration: https://spaces.internet2.edu/x/dpiKAQ

> We still have one that is failing (after the metadata publication,
> both before and after changing our cert/key on the SP) with the following
> error in the logs:
> ERROR: spAssertionConsumer.jsp: SSO failed.
> com.sun.identity.saml2.common.SAML2Exception: Failed to decrypt the secret
> key.

Did you configure two decryption keys in your SP? My guess is the IdP
used a encryption certificate in metadata that doesn't have a
corresponding decryption key in the SP software.

Tom
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160604/b7a69a7a/attachment.html>