Shibboleth IdP and LetsEncrypt

[Cantor, Scott]

> I am using the Shibboleth IdP 5 software on Windows using
> the installer. Does anyone have any recommendations on
> how to implement LetsEncrypts certificates with the
> packaged version of Jetty?

What you really mean is how to auto-reload the keystore at runtime, and I believe officially you can't since that requires a separate Jetty module and I don’t think we support use of custom Jetty config and modules with that packaged approach because we can't keep it working when you're altering things.

There's a reason we strongly advise people not to rely on a Jetty or Tomcat server you don't fully own and control.

Install and operate it yourself, and Jetty has a module for monitoring keystores for reload. It doesn't work with symlinks from what I can tell, but it works in general.

The IdP plugin we're working on to deliver Jetty will have, I think, different constraints that may be more relaxed in terms of allowing that sort of custom behavior, though with less guarantee that things won't break on updates, but the plugin's intent is just to help automate Jetty updates and make Docker work more cleanly with the IdP, not guarantee they will always work.

-- Scott