SP's certificate rollout impact on IdPs

[Kannan, Satheesh (ELS)]

Hi Scott,

Could you explain us the migrate process for a signing key and encryption key. How this would work for those idp wanted to use new certificate?
So, you are meant to say,  idp should be sharing the signing key to SP. In turn, Sp would be adding this key name to  additional certificate underneath that credential chain.
How to enforce SP using new certificate to an specific IDP?  In that case, old sp certificate won't work, only works with new certificate . Could you explain us the role of encryption key here?

Thanks for your reply, in advance.

Thanks,
Satheesh Kannan



-----Original Message-----
From: users <users-bounces at shibboleth.net> On Behalf Of Cantor, Scott
Sent: Monday, March 1, 2021 7:45 PM
To: Shib Users <users at shibboleth.net>
Subject: Re: SP's certificate rollout impact on IdPs

*** External email: use caution ***



You migrate signing keys by publishing new keys ahead of time before they're added to an SP configuration so that by the time it uses the key, the IdPs all have it or have been told about the change.

>How we are planning to do certificate rollout?

That is not the right process for a signing key. Nor is it correct for an encryption key.

-- Scott


--
For Consortium Member technical support, see https://nam03.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwiki.shibboleth.net%2Fconfluence%2Fx%2FcoFAAg&data=04%7C01%7Cs.kannan.1%40elsevier.com%7C02ee8f4f5ab847cd4e2e08d8dcbc6a24%7C9274ee3f94254109a27f9fb15c10675d%7C0%7C0%7C637502049103894244%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=0Tt5KaDs%2BEf5EjaHm2IL9VlsHLOxyb8VPUvtR%2FREViw%3D&reserved=0
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net

________________________________

Elsevier Limited. Registered Office: The Boulevard, Langford Lane, Kidlington, Oxford, OX5 1GB, United Kingdom, Registration No. 1982084, Registered in England and Wales.