Shibboleth Identity Provider Security Advisory [4 October 2017]

[Cantor, Scott]

> Hmm, does that make it fragile in the sense that we have to be cognizant
> of the LDAP server's expirations and such (if using just the LDAP server's
> cert)?

Not if it isn't expiring for no good reason.

> By CA, do you mean just the root cert for the CA issuing the LDAP server's
> cert, or a cert that encompasses some or all of the certificate chain?
> Even there, do we need to worry about expiration of any of the CA certs?

It's standard PKIX by default, it's the same as any client evaluating the trust chain of a server, like a browser and web server. You decide the trust anchor and everything that's below it has to be presented by the server.

> I suppose if we upgrade to V3.3.2 before any of the aforementioned
> certificate expirations, it's probably moot since the underlying problem
> get's resolved by the underlying ldap component fix?

We will no longer support this defaulting nonsense in the future, this is the last security bug we're going to fix on that. Trust cannot be automatic. You should fix it now and decide how you want or need to establish the validation.
 
-- Scott