Impact of Reduced TLS Certificate Lifetimes on CA-Signed SAML Certificates

[Joseph Fischetti]

It may help to clarify what I think Scott and Peter are pointing out - for those that haven't found the relevant portion of the doc that Peter linked to - I believe it's in section 2.5.1: [1].

I find it infuriating when SPs force an update on their certs/keys due to expiration, especially because not all of them have an automated rollover process.

-----------------

[1]: In the case of an X.509 certificate, there are no requirements as to the content of the certificate apart from the requirement that it contain the appropriate public key. Specifically, the certificate may be expired, not yet valid, carry critical or non-critical extensions or usage flags, and contain any subject or issuer. The use of the certificate structure is merely a matter of notational convenience to communicate a key and has no semantics in this profile apart from that. However, it is RECOMMENDED that certificates be unexpired.

Joe Fischetti
Senior System Administrator
Marist College
E-mail: joseph.fischetti at marist.edu