IDP with multiple cert

[Peter Schober]

* Zico via users <users at shibboleth.net> [2023-02-24 05:06]:
> I would like to get some idea if it's possible to have my IDP with multiple
> cert?
> Meaning... it's more like federation metadata but there will be just two
> sets of idp-signing and idp-encryption keys in my metadata.

For signing:

With the exception of specific configurations for certain relying
parties where you tell the IDP to sign with a different key the IDP
can really only have one signing key configured at any given time.
  For relying parties (SAML SPs) that can deal with multiple
certificates of use="signing" in metadata you can publish multiple
such certificates ahead of time and then switch the one signing key in
your IDP configuration for the other/new signing key. (I.e., metadata
has 2 but you active IDP configuration only ever needs 1.)
  For relying parties that do not support this you could use the
method for exceptions I mentioned before:
https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1265631697/SecurityConfiguration

For encryption:

The IDP already supports 2 key pairs for decrypting received requests
or responses (which you may not even need) via pre-defined
idp.encryption.{key,cert} and idp.encryption.{key,cert}.2 properties
in your conf/idp.properites file.

-peter