<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<base href="x-msg://6615/">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">
Yusuf,
<div><br>
</div>
<div>This isn't really a Shibboleth question, but answers below.</div>
<div><br>
</div>
<div>
<div>
<blockquote type="cite"><span class="Apple-style-span" style="border-collapse: separate; font-family: Helvetica; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; font-size: medium; ">
<div lang="EN-GB" link="blue" vlink="purple">
<div class="WordSection1" style="page: WordSection1; ">
<div style="margin-top: 0cm; margin-right: 0cm; margin-left: 0cm; margin-bottom: 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">
Could you advise on the best strategy for creating and implementing the certificate(s)? I've seen guides to do this for one server but not 2 load balanced servers.</div>
</div>
</div>
</span></blockquote>
<div><br>
</div>
<div>You can give them the same certificate and keypair as long as the hostname they use when communicating with the IdP matches the load balancer, just like you did for the IdPs and SPs.</div>
<div><br>
</div>
<div>The certificate will need to be trusted by the IdP's. You can do that by adding it directly to the Java truststore, yes.</div>
<br>
<blockquote type="cite"><span class="Apple-style-span" style="font-family: Calibri, sans-serif; font-size: 15px; ">Will I need to do anything special like create a wildcard cert and try to use the same cert on both DC's?</span><span class="Apple-style-span" style="border-collapse: separate; font-family: Helvetica; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; font-size: medium; "></span></blockquote>
<div><br>
</div>
<div>No. If they speak to the IdP's using different domain names, a subjectAltName is the most you will need to do.</div>
</div>
<br>
</div>
<div>Thanks,</div>
<div>Nate. </div>
</body>
</html>