Base 64 encoded certificates

[Julien Cochennec]

Yes, it helps, thanks a lot Nate.

I couldn't find the key on the docker image (it's in /run/secrets), but 
now I get I just need the certificate .pem for the metadata.


Le 21/09/2020 à 18:29, Nate Klingenstein a écrit :
> Julien,
>
> This question is probably best suited for the users' list rather than the developers' list, so I've rerouted you.  Any RSA keypair of 2048 or 4096 bytes should suffice and there are many tools that can create it.  The simplest to create each keypair and a certificate would be:
>
> openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -nodes -days 7300
>
> Use appropriately restrictive file permissions on the private key and store it where you would like.  The contents of the certificate don't matter to Shibboleth, as it's basically just a bag for the certificate, but they may if you're working with other implementations.  Be very careful about copying or sharing your private key if you're clustering, because anyone who has it can impersonate your provider.  The base64 certificate, minus the -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- lines, goes into your metadata as specified by the schema.
>
> If you're using Shibboleth itself, it will generate keypairs and certificates itself on a fresh install anyway.
>
> Key rollover is a very painful process.  Investing time in protecting your credentials is worth much more than the large amount of time and potential vulnerabilities that rekeying requires.
>
> Useful reference docs:
>
> https://wiki.shibboleth.net/confluence/display/CONCEPT/Metadata
> https://wiki.shibboleth.net/confluence/display/CONCEPT/MetadataForIdP#MetadataForIdP-Keys
> https://wiki.shibboleth.net/confluence/display/CONCEPT/MetadataForSP#MetadataForSP-Keys
> https://wiki.shibboleth.net/confluence/display/CONCEPT/MetadataKeyDescriptor
>
> A couple complete examples:
>
> https://samltest.id/saml/idp
> https://samltest.id/saml/sp
>
> Hope this helps,
> Nate.
>
> --------
> Signet, Inc.
> The Art of Access ®
>
> https://www.signet.id
>   
>   
> -----Original message-----
>> From: Julien Cochennec
>> Sent: Monday, September 21 2020, 2:34 am
>> To: Shib Dev
>> Subject: Base 64 encoded certificates
>>
>> Hi,
>>
>> Does anyone have a good step by step guide about how to deal with base
>> 64 encoded certificates in Metadata for both Idp and Sp?
>>
>> Good security practice about it, how to generate it, and so on.
>>
>> I'd like to automate this on docker containers but any good detailed
>> tutorial on VM would be fine. Thanks.
>>
>> -- 
>> Julien Cochennec
>> Pôle de compétences - gestion des identités
>>
>> -- 
>> To unsubscribe from this list send an email to dev-unsubscribe at shibboleth.net
>>
-- 
Julien Cochennec
Pôle de compétences - gestion des identités

Mél julien.cochennec at ac-orleans-tours.fr
Tél 02 38 83 48 88

DSI - Rectorat d'Orléans-Tours
10 Rue Molière
45000 Orléans
www.ac-orleans-tours.fr