Base 64 encoded certificates

[Nate Klingenstein]

Julien,

This question is probably best suited for the users' list rather than the developers' list, so I've rerouted you.  Any RSA keypair of 2048 or 4096 bytes should suffice and there are many tools that can create it.  The simplest to create each keypair and a certificate would be:

openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -nodes -days 7300

Use appropriately restrictive file permissions on the private key and store it where you would like.  The contents of the certificate don't matter to Shibboleth, as it's basically just a bag for the certificate, but they may if you're working with other implementations.  Be very careful about copying or sharing your private key if you're clustering, because anyone who has it can impersonate your provider.  The base64 certificate, minus the -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- lines, goes into your metadata as specified by the schema.

If you're using Shibboleth itself, it will generate keypairs and certificates itself on a fresh install anyway.

Key rollover is a very painful process.  Investing time in protecting your credentials is worth much more than the large amount of time and potential vulnerabilities that rekeying requires.

Useful reference docs:

https://wiki.shibboleth.net/confluence/display/CONCEPT/Metadata
https://wiki.shibboleth.net/confluence/display/CONCEPT/MetadataForIdP#MetadataForIdP-Keys
https://wiki.shibboleth.net/confluence/display/CONCEPT/MetadataForSP#MetadataForSP-Keys
https://wiki.shibboleth.net/confluence/display/CONCEPT/MetadataKeyDescriptor

A couple complete examples:

https://samltest.id/saml/idp
https://samltest.id/saml/sp

Hope this helps,
Nate.

--------
Signet, Inc.
The Art of Access ®

https://www.signet.id
 
 
-----Original message-----
> From: Julien Cochennec
> Sent: Monday, September 21 2020, 2:34 am
> To: Shib Dev
> Subject: Base 64 encoded certificates
> 
> Hi,
> 
> Does anyone have a good step by step guide about how to deal with base 
> 64 encoded certificates in Metadata for both Idp and Sp?
> 
> Good security practice about it, how to generate it, and so on.
> 
> I'd like to automate this on docker containers but any good detailed 
> tutorial on VM would be fine. Thanks.
> 
> -- 
> Julien Cochennec
> Pôle de compétences - gestion des identités
> 
> -- 
> To unsubscribe from this list send an email to dev-unsubscribe at shibboleth.net
>