multiple signing certs for SP

[IAM David Bantz]

Arguably the vendor is ignoring encryption; they do not consume encrypted
SAML assertions, and the cert is explicitly designated for use as signing
cert.

David Bantz

On Thu, Sep 22, 2016 at 11:09 AM, Cantor, Scott <cantor.2 at osu.edu> wrote:

> > A vended SP is upgrading their signing cert to one signed with
> > sha512WithRSAEncryption . Adding the new cert as a second signing cert
> into
> > their SP metadata seems the seamless way to ease the transition,
> eventually
> > removing the old SHA1 signed cert after the transition is complete. I'm
> > assuming/hoping IdP v2 will verify their SAML assertion which ever of the
> > two certs they use to sign the assertion. Or is this more complex than
> I've
> > assumed?
>
> That's how it works, but it is much more complex than that because you're
> ignoring encryption. I don't know if you're talking about a signing key or
> a dual use key being used to encrypt data under. Both cases are discussed
> at length in the wiki and I think InCommon has additional material on it.
>
> -- Scott
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160922/a6bd6aa3/attachment.html>