"Basic Constraints" settings in IDP signing certificate

[Cantor, Scott]

The only standard for this [1] specifies very directly that absolutely nothing in the certificate matters but the public key, and that is what we implement.

As far as what we generate, I actually have no idea. The SP certainly does use OpenSSL for that, it's just a shell script in fact but there's a custom openssl.conf fed in to do it.

The IdP certainly does not use OpenSSL anywhere, it's pure Java only.

I don't know what ends up in either one of them in this respect.

There are no formal specs for using certificates in SAML that involve any of the actual content. Not one. Any time you see software failing due to expiration or anything else, that's a bug. End of story. Not because it couldn't have been specified in that way, but because it *wasn't*. Nobody making the case for that ever specified it.

We had a mode for PKIX but we only documented it for our software and it requires metadata extensions that have never been used anywhere else. It's deprecated.

-- Scott

[1] https://wiki.oasis-open.org/security/SAML2MetadataIOP