sp-signing-key not recognized after upgrade

[Björn Mattsson]

Hi.

> On 20 Mar 2025, at 16:15, Jonathan Proulx via users <users at shibboleth.net> wrote:
> 
> Hi All,
> 
> I just (temporarily?) inherited management of an application using
> Shibboleth via Apache2 mod_shib.
> 
> I'm trying to move from a Debian11 based docker image to a Debian12
> based docker image due to the recent security advisory.
> 
> But after rebuilding (using the same key that works in the older
> image) I get "Unable to load private key from file
> (/etc/shibboleth/sp-encrypt-key.pem)" in shibd.log.

Are you mounting the key from the host into the Shibboleth-container ?
If so the uid that _shib gets have changed from Debian 11 to Debian 12.
I hade the same problem and after changing owner from uid 101 to 100 I got my SP to start again.

// Björn M.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: Message signed with OpenPGP
URL: <http://shibboleth.net/pipermail/users/attachments/20250320/c247d5ad/attachment.sig>