Impact of Reduced TLS Certificate Lifetimes on CA-Signed SAML Certificates

[Peter Schober]

Tim van Dijen via users <users at shibboleth.net> [2025-05-24 18:07 CEST]:
> This assumes self-signed certificates, because no public CA will
> ever allow the re-use of a private key. - Tim

Besides the fact that this is simply not the case (as pointed out by
others): You seem to suggest that using self-signed certificates to
secure SAML protcol messages were somehow impossible (or insane) and
not, you know, the most sensible way to implement SAMLMetaIOP?

Quoting Scott from a few messages earlier[1] for completeness:

> I do not see a likely scenario where CAs start issuing "SAML"
> certificates, and thus subject them to different policies. They do not
> issue certificates today that have any sensible use in SAML. Anybody
> doing that is misusing them and on some pedantic level asserting
> something the CA never intended them to assert about the key.

Best regards,
-peter

[1] https://shibboleth.net/pipermail/users/2025-May/056450.html