using cert in SP metadata for encryption

[Cantor, Scott]

On 11/19/16, 10:06 AM, "users on behalf of Craig Pluchinsky" <users-bounces at shibboleth.net on behalf of craigp at iup.edu> wrote:
>
>   Misunderstanding on my part. Thanks for the info.

Unfortunately it's usually not that simple.

> The expiration date will be ignored by Shibboleth (in all but the most
>  unusual deployments) and "expire in a couple years" will be true of
>   basically all certs you will encouter, whether they're self-signed or
>    from some CA (commercial or otherwise).

The problem is that a lot, probably most, SPs that use those certificates have implementations that actually care whether their own public key has "expired" and won't allow it to be used for decryption. Most of the time if you see an SP using a short lived certificate for encryption, you can bet it's a time bomb if you enable encryption. I generally avoid using it if I know it's going to be an issue and tell them it's a bug (which they don't listen to).

-- Scott