<html><body><div style="color:#000; background-color:#fff; font-family:arial, helvetica, sans-serif;font-size:12pt"><div>My cert in InCommon is expired and as such I am looking to update
it. I probably would never have noticed it was expired had I not tried
to integrate with Ball State. They are using an AD FS based Idp and it
balked at the expired cert. Below is the process that I intend to
follow. Just looking to get a sanity check on my process before I
proceed since the potential impact could be ugly if I make a misstep
here. Moreover, once I have completed this process, will Ball State
have to wait until I remove the old cert / old cert config after the 3
week propagation period? I am on IIS running Shib 2.<br></div><div><br></div><div>Here is my proposed process:</div><div><br></div><div>1. Create new credentials:<br><br>cd C:\Temp<br>C:\opt\shibboleth-sp\etc\shibboleth\keygen.bat -y 20 -h <a target="_blank" href="http://www.lynda.com/"><span class="yshortcuts" id="lw_1319129330_0">www.lynda.com</span></a> -e
<a target="_blank" href="https://shib.lynda.com/shibboleth-sp"><span class="yshortcuts" id="lw_1319129330_1">https://shib.lynda.com/shibboleth-sp</span></a><br>mv sp-cert.pem C:\opt\shibboleth-sp\etc\shibboleth\sp-cert-2011.pem<br>mv sp-key.pem C:\opt\shibboleth-sp\etc\shibboleth\sp-key-2011.pem<br><br>2. Update Shibboleth2.xml"<br> <br> Change old setting FROM:<br> <br> <!-- Your SP generated these credentials. They're used to talk to IdP's. --><br> <CredentialResolver type="File" key="sp-key.pem" certificate="sp-cert.pem"/><br> <br> TO:<br><br> <br> <CredentialResolver
type="Chaining"><br> <!--
<br> Certificate/Private key pairs are read in sequence.<br> Unless specificially defined only the first <br> CredentialResolver is used for attribute requests.<br> --><br> <CredentialResolver type="File" keyName="Active" <br> key="C:\opt\shibboleth-sp\etc\shibboleth\sp-key.pem"
<br> certificate="C:\opt\shibboleth-sp\etc\shibboleth\sp-cert.pem"/><br> <CredentialResolver type="File" keyName="Standby" <br> key="C:\opt\shibboleth-sp\etc\shibboleth\sp-key-2011.pem" <br> certificate="C:\opt\shibboleth-sp\etc\shibboleth\sp-cert-2011.pem"/><br>
</CredentialResolver><br> <br>3. Add new cert to Incommon:<br><br>Add new <md:Keydescriptor> (bereft of the use="signing" XML element)<br>Change old <md:Keydescriptor> - Add use="signing" XML element (using dropdown in interface)<br><br>4. Wait 3 weeks for propogation:<br><br>5. Update Shibboleth2.xml to remove old credential reference:<br><br> Change old setting FROM:<br><br> <CredentialResolver type="Chaining"><br> <!-- <br> Certificate/Private key pairs are read in sequence.<br> Unless specificially defined only the first <br> CredentialResolver is used for
attribute requests.<br> --><br> <CredentialResolver type="File" keyName="Active" <br> key="C:\opt\shibboleth-sp\etc\shibboleth\sp-key.pem" <br> certificate="C:\opt\shibboleth-sp\etc\shibboleth\sp-cert.pem"/><br> <CredentialResolver type="File" keyName="Standby"
<br> key="C:\opt\shibboleth-sp\etc\shibboleth\sp-key-2011.pem" <br> certificate="C:\opt\shibboleth-sp\etc\shibboleth\sp-cert-2011.pem"/><br> </CredentialResolver><br><br> TO:<br> <br> <!-- Your SP generated these credentials. They're used to talk to IdP's. --><br> <CredentialResolver type="File" key="sp-key-2011.pem"
certificate="sp-cert-2011.pem"/><br> <br>6. Remove old <md:Keydescriptor> (with use="signing" XML element) from InCommon</div><div><br></div><div>If anyone sees any issues with my process here, any comments are appreciated!</div><div><br></div><div>Thanks!</div><div><br></div>Mike</div></body></html>