Shib IdP v3: Which certificate do you upload to InCommon?

[Cantor, Scott]

> I was about to change our InCommon IdP information to list our v3 IdP, but
> I'm not sure which certificate I should be uploading. The signing one? All
> three?

You shouldn't be changing anything. Your IdP should be using the same signing key as before. If you were using it for SOAP, then you should also be using that key for your container's SOAP port. The only reason you should be changing a key is if it's compromised, or if you want to roll out a new one, in which case you have a very long process ahead and you can't do it by just changing the key all at once.

InCommon does not have support for encryption-only keys so there's nothing you can do with the separate key at the moment in the federation's mtadata interface.

If there's something in the SecurityAndNetworking topic you don't understand, you should absolutely stop until you do, and ask about it.

-- Scott