Transitioning from an old to new IdP instance

[Peter Schober]

coupons at sccoast.net <coupons at sccoast.net> [2025-05-14 14:16 CEST]:
> What I actually did was a fresh install of Shib 5.x on our dev
> server got it running good and working with all SP's, no errors.
[...]
> Finally I was going to copy over the 'credentials' -
> signing/encryption certs/keys from our old Shib 3.x to the new Shib
> 5.x and hoping that would be good to go.

How could you have determined that it was
"working with all SP's, no errors"
when the IDP didn't even have the established keys?
I.e., you cannot possibly have tested this with real SPs -- or they're
all fundamentally broken by letting you in with messages signed with
completely different keys.

> These steps seem like they would work ok.

Unless/Until they don't. E.g. when the new software uses new defaults
for encryption algorithms that some of your SPs are not compatible
with.

-peter