IdP Signing Certificate question

[Andrew Jason Morgan]

Ahhh, yes.  I remember setting up a few SPs that explicitly asked for the certificate fingerprint (they didn't even take the certificate itself).  Obviously, that won't work.  So you're effectively left with doing the work of a key rollover anyways.

I suppose the small fix for this particular SP is to configure the IDP to use a different signing key/cert for this one SP.

Thanks for the explanation.

Andy


________________________________
From: users <users-bounces at shibboleth.net> on behalf of Cantor, Scott <cantor.2 at osu.edu>
Sent: Thursday, January 21, 2021 11:29 AM
To: Shib Users <users at shibboleth.net>
Subject: Re: IdP Signing Certificate question

[This email originated from outside of OSU. Use caution with links and attachments.]

On 1/21/21, 2:14 PM, "users on behalf of Andrew Jason Morgan" <users-bounces at shibboleth.net on behalf of morgan at oregonstate.edu> wrote:

>    Is it possible to generate a new, self-signed cert using a modern signing algorithm such as SHA-256 from the same
> private key?

Yes.

>  If so, won't data signed/encrypted with the private key still be able to be validated/decrypted by the SP which has the
> new cert?

This is about signing, encryption is in the other direction, and it's the opposite, whether an SP with the old certificate will continue to work if the new one is included in the signature's KeyInfo element. The certificate has nothing to do with the math of signing or encrypting data, that's about the key alone.

But the answer is that there is exactly one SAML implementation with a fully documented and standardized answer, and that answer is yes. The answer for everything else is "maybe" and the answer for much of it is "no", they compare the certificates or certificate fingerprints in ways that defeat such a change.

-- Scott


--
For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20210121/3e8babad/attachment.htm>