IdP signing cert update

[Spencer Thomas]

Ah, the "certificate" expiration date for the signing key is actually irrelevant to the SP?  That would explain why, although I think their certificate expired on 9/5, there were no problems at our end until they replaced it on 9/25. I wonder why they decided they needed to replace it.  Maybe something on their end complained.  The attributes for their new key cert are (below) which suggests that maybe ADFS had an issue with it?    Whatever.  We will point them to https://spaces.at.internet2.edu/display/federation/Key+Rollover for the future.

Common Name: ADFS Signing - xxxx.xxx.xxx
Valid From: September 5, 2020
Valid To: September 5, 2021
Serial Number: 295ece7540f79fad4dc1786435c01a31

By metadata aware, you mean we are retrieving metadata periodically by download or by query?  We are definitely doing that.

--
Spencer Thomas
Technical Architect / JSTOR and Artstor
ITHAKA <https://www.ithaka.org/> / 301 E. Liberty St, Suite 250, Ann Arbor, MI 48104
Email: Spencer.Thomas at ithaka.org
Voicemail: 734-887-7004
 
 
 


On 10/2/20, 12:32 PM, "users on behalf of Cantor, Scott" <users-bounces at shibboleth.net on behalf of cantor.2 at osu.edu> wrote:

    On 10/2/20, 12:19 PM, "users on behalf of Spencer Thomas" <users-bounces at shibboleth.net on behalf of Spencer.Thomas at ithaka.org> wrote:
    
    >    By the time we got the support ticket, the issue had actually self-resolved.  But in the process of diagnosing the issue, I
    > noticed that their new signing certificate expires in a year.
    
    Any software that notices is broken. There is no expiration except the metadata itself.
        
    It is entirely possible and well documented by InCommon, provided the SP is metadata-aware. Rolling signing keys is trivial in a metadata-aware system. Rolling encryption keys is harder.
    
    -- Scott