<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">
<div>
<blockquote type="cite">
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; ">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); ">Thanks! So the x.509 is the “signature”.</span></div>
</blockquote>
<div><br>
</div>
<div>No, X.509 is an old system designed for PKI. XML Dsig is the "signature". The certificates and keys and ASN.1 encoding somehow lived on, but the PKI validation in Shibboleth is preferably done simply by signature evaluation and direct public key comparison.
It can also do PKIX.</div>
<br>
<blockquote type="cite">
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; ">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); ">Now to look up PKI and why the metada.xml file has the same x.509 info listed twice, once as”signed” and once as “encrypt” (I think)</span></div>
</blockquote>
</div>
<br>
<div>A provider can use one keypair to sign messages and advertise a distinct public key to receive encrypted messages. You can also choose to use one keypair for both purposes, in which case you'd list only the one and give it no specific usage constraint.</div>
</body>
</html>