SP certificate rollover

[Cantor, Scott]

On 3/7/17, 3:01 AM, "users on behalf of Etienne Dysli-Metref" <users-bounces at shibboleth.net on behalf of etienne.dysli-metref at switch.ch> wrote:

> Our certificate rollover guide that you cite has key names in the *SP's*
> *configuration* to help humans distinguish those keys. SWITCHaai
> federation metadata does not contain any KeyName element (have a look at
> http://metadata.aai.switch.ch/metadata.switchaai.xml).

Even that can cause problems. The problem is that the SP tries to use those keys to match credentials it sees in a KeyInfo hint, and when things don't match it can incorrectly skip trying a key. That's why I advise against all of that, it was an idea that didn't really work out well. Using comments is usually a better choice.

-- Scott