SP's certificate rollout impact on IdPs

[Kalluru, Prasanth (ELS-LON)]

Hi,

Which certificate used for signing by the SP when trying to rollout new certificate in SP?

IDPs that has enabled flag WantAuthnRequestsSigned="true" in metadata xml.
Can someone explain us, what could be the impact for an IDP and SP when doing certificate rollout in SP?
In this case, IDPs having old certificate and  SP having both active certificate and additional new certificate configured under CredentialResolver config in shibboleth2.xml. Which certificate will SP use for signing in this case?

How we are planning to do certificate rollout?
1. Created new certificate and Copied the certificate to the correct location /etc/shibboleth.
2. Configure new certificate as 'additional new certificate in shibboleth2.xml.
        <CredentialResolver type="Chaining">
             <!-- Active certificate -->
             <CredentialResolver type="File"
                                 key="/etc/shibboleth/sp-key.pem"
                                 certificate="/etc/shibboleth/sp-cert.pem"/>
             <!-- Additional new certificate -->
             <CredentialResolver type="File"
                                 key="/etc/shibboleth/sp-key-2021.pem"
                                 certificate="/etc/shibboleth/sp-cert-2021.pem"/>
        </CredentialResolver>
3. Add new certificate to SP metadata
4. Request IDP to use the new certificate for authentication.

Thanks in Advance,
Prasanth
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20210301/be12c741/attachment.htm>