SP certificate rollover

[Ondřej Košarko]

Hello everyone,
I've run into some difficulties while rolling over the certificate in our
sp config and would like to check on some of those with you. I was
following this https://www.switch.ch/aai/guides/sp/certificate-rollover/
guide:
I've added the new certificate to the sp config
Started distributing metadata with the new cert to federations (the sp is
member of multiple); the communication with some was faster than with
others; so there were federations with just the old cert, with both, and
with just the new one (because the ui didn't let you to have more than one).
Now the impression was that the sp will still work with any idp from any of
those federations. But error messages saying "Message did not meet security
requirements" appeared on those having just the new cert.

What role does the order of certificates in the Chaining resolver play? Is
the first the one and only used for signing the authNrequest? That would
explain errors from idps having just the new one (as we did have the old
one at the first place), wouldn't it?

How do multiple certs work on the idp side? Because after removing the old
cert from the config, issues with idps having both certs emerged:
"opensaml::FatalProfileException A valid authentication statement was not
found in the incoming message". The authNrequest was signed with the new
cert and the idp was happy, because it knows both; but the idp encrypted
the assertion with the old one and the sp couldn't make sense of that. Is
that plausible? How does the idp choose what to encrypt with? Is it the
order of  the keys in the metadata? Can keyName play any role?

Finally, you cannot prevent a "downtime" when you are allowed to have only
one cert in the metadata, or can you?

Best,
Ondrej
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170303/9090104e/attachment.html>