<html><body><div style="color:#000; background-color:#fff; font-family:arial, helvetica, sans-serif;font-size:12pt"><div><span>Thanks, Tom. So, based on your comments, my step 2 will look like this:</span></div><div><br><span></span></div><div><span> Change old setting FROM:<br> <br> <!-- Your SP generated these credentials. They're used to talk to IdP's. --><br> <CredentialResolver type="File" key="sp-key.pem" certificate="sp-cert.pem"/><br> <br> TO:<br><br> <br> <CredentialResolver type="Chaining"><br> <!--
<br> Certificate/Private key pairs are read in sequence.<br> Unless specificially defined only the first <br> CredentialResolver is used for attribute requests.<br> --><br> <CredentialResolver type="File" keyName="Standby" use="encryption"<br> key="C:\opt\shibboleth-sp\etc\shibboleth\sp-key-2011.pem"
<br> certificate="C:\opt\shibboleth-sp\etc\shibboleth\sp-cert-2011.pem"/><br> <CredentialResolver type="File" keyName="Active" <br> key="C:\opt\shibboleth-sp\etc\shibboleth\sp-key.pem" <br> certificate="C:\opt\shibboleth-sp\etc\shibboleth\sp-cert.pem"/><br>
</CredentialResolver><br></span></div><div><br><span></span></div><div><span>That about right? I now need to contact the Canadian CAF to see how to coordinate this change with them at the same time as InCommon <sigh/></span></div><div><br></div><div style="font-family: arial, helvetica, sans-serif; font-size: 12pt;"><div style="font-family: times new roman, new york, times, serif; font-size: 12pt;"><font size="2" face="Arial"><hr size="1"><b><span style="font-weight:bold;">From:</span></b> Tom Scavo <trscavo@gmail.com><br><b><span style="font-weight: bold;">To:</span></b> Shib Users <users@shibboleth.net><br><b><span style="font-weight: bold;">Sent:</span></b> Thursday, October 20, 2011 1:48 PM<br><b><span style="font-weight: bold;">Subject:</span></b> Re: Cert rollover sanity check<br></font><br>
On Thu, Oct 20, 2011 at 12:50 PM, Mike Flynn <<a ymailto="mailto:shibbolethlynda@yahoo.com" href="mailto:shibbolethlynda@yahoo.com">shibbolethlynda@yahoo.com</a>> wrote:<br>><br>> If anyone sees any issues with my process here, any comments are<br>> appreciated!<br><br>Your metadata looks good, but I think you want to take another look at<br>your software configuration. At your step 2, you want to make sure<br>that the new key is used as a *decryption key only*. You don't want to<br>sign with the new key because not all IdPs will have the new metadata.<br>So I suggest you add use="encryption" to the configuration of the new<br>key.<br><br>Once you do that, you can safely move the new key to be first in the<br>chain. As the migration proceeds, and the new metadata propagates, the<br>best decryption key to try first (from an efficiency point of view) is<br>the new decryption key.<br><br>As far as the wait time is concerned, I don't disagree
with anything<br>that Scott said. However, if you make the changes discussed above, you<br>can wait indefinitely without penalty, so unless you're 100% sure that<br>all IdPs have refreshed their metadata, there's no harm in waiting.<br>Keep in mind that InCommon metadata has a three-week lifetime. After<br>three weeks, the metadata expires and software starts to fail. So I'd<br>feel pretty confident that all IdPs have refreshed by then.<br><br>Tom<br>--<br>To unsubscribe from this list send an email to <a ymailto="mailto:users-unsubscribe@shibboleth.net" href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br><br><br></div></div></div></body></html>