Questions about upgrading SP v2 to SP v3

[Meiselman, Ellen]

Hi,
I’m about to upgrade a couple of v2 SP’s to v3. It looks as if it is possible to leave the old shibboleth2.xml configuration file in place – is that a best practice? Or should I attempt to bring that file up to date? I have a working example of one to use as a model.

If I do update to the v3 version of shibboleth2.xml, do I also now need to separate out the signing/encryption keys?
I’d really rather not right now since it will mean swapping metadata with our IdP.

Are the split keys a requirement of v3 or a best practice? I can’t tell from the wiki or the v3 file if it will work to use the old-style 1-key entry, or to use the same key name for the 2 different types of key:

For example, would this old-style entry work?
<!-- Simple file-based resolver for using a single keypair. -->
        <CredentialResolver type="File" key="sp-key.pem" certificate="sp-cert.pem"/>

Or would this new-style entry work, using the same key in both places?
        <!-- Simple file-based resolvers for separate signing/encryption keys. -->
        <CredentialResolver type="File" use="signing"
            key=" sp-cert.pem " certificate=" sp-key.pem "/>
        <CredentialResolver type="File" use="encryption"
            key=" sp-cert.pem " certificate=" sp-key.pem "/>



_________________
Ellen Meiselman
MLearning Team
Michigan Medicine
Arbor Lakes, B2F3, C#119
Ann Arbor, MI
734-223-6206


**********************************************************
Electronic Mail is not secure, may not be read every day, and should not be used for urgent or sensitive issues 
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20190325/77e509e1/attachment.html>