<div dir="ltr">On Mon, Apr 22, 2013 at 6:29 PM, David Bantz <span dir="ltr"><<a href="mailto:dabantz@alaska.edu" target="_blank">dabantz@alaska.edu</a>></span> wrote:<br><div class="gmail_extra"><div class="gmail_quote">
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">It must be fairly common for IdP deployments to depend upon LDAP from AD component of a Domain Controller. I am inquiring about strategies for this dependency - specifically, the use of X.509 certificates for establishing encrypted communications between the IdP and AD LDAP.<br>
<br>
We're exploring a number of options in response to our Windows Server group recently determining they will exclusively use the internal Microsoft certificate generator and private CA for use within the Domain. I am soliciting the experience of other institutions with similar deployments. Do you:<br>
<br>
<br>b) Import the certificate for the Domain's private CA into an alternate location for java trusted CA?<br>
<br></blockquote><div><br></div><div>This is my preferred solution. I like the trust dependencies to be declared in the configuration, even for certificates that would otherwise be trusted by default, and stored with the configuration. Storing certificate dependencies in cacerts invites problems associated with JVM upgrade and certificate expiration.</div>
<div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
In either case, how do you ensure that both the private CA and other well-known CAs have up-to-date certificates in that store?<br></blockquote><div><br></div><div style>CA expiration is typically greater than five years, and those transitions should be well communicated and planned.<br>
</div><div style><br></div><div style>--Daniel Fisher</div><div style><br></div></div></div></div>