Upgrade SP with intermediate certificate

[Avirup Neogi]

I am trying to upgrade the browser-facing certificate on the Service
Provider (sp). I have generated a new certificate which includes a domain
certificate and an intermediate certificate. I have combined both the
certificates into a single file in pem format.

Then I have updated shibboleth2.xml (after notifying all the stakeholders
about the change) to point to the new certificate:

However I have couple of questions how to update the sp-metadata.xml with
the new certificate:


1. Do I really have to provide both domain and intermediate certificate
details or the domain certificate should be enough for IdPs to connect to
the my sp?

2. If both the certificates are required, how should my sp-metadata.xml
look like among the following options ?

(a) Multiple <ds:X509Certificate> elements within same <ds:KeyInfo> element
<ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<ds:KeyName>key-name</ds:KeyName>
<ds:X509Data>
<ds:X509SubjectName>domain-name</ds:X509SubjectName>
<ds:X509Certificate>domain-certificate</ds:X509Certificate>
<ds:X509Certificate>intermediate-certificate</ds:X509Certificate>
</ds:X509Data>
</ds:KeyInfo>

(b) Multiple <ds:KeyInfo> elements
<ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<ds:KeyName>domain-key-name</ds:KeyName>
<ds:X509Data>
<ds:X509SubjectName>domain-name</ds:X509SubjectName>
<ds:X509Certificate>domain-certificate</ds:X509Certificate>
</ds:X509Data>
</ds:KeyInfo>
<ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<ds:KeyName>intermediate-key-name</ds:KeyName>
<ds:X509Data>
<ds:X509SubjectName>intermediate-name</ds:X509SubjectName>
<ds:X509Certificate>intermediate-certificate</ds:X509Certificate>
</ds:X509Data>
</ds:KeyInfo>


I have also raise the question in Stack Overflow (
http://stackoverflow.com/questions/38054193/saml2-upgrade-sp-with-intermediate-certificate
)

Thanks in advance.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160627/95b141a0/attachment.html>