<div dir="ltr">Hello Widdowson Thank you for your reply,<div>We have the lines in relying-party.xml which are commented out like below.</div><div><br></div><div><div><!-- security:Credential id="IdPCredential" xsi:type="security:X509Filesystem" --></div><div> <!-- security:PrivateKey>d:\IdP/credentials/idp.key</security:PrivateKey--></div><div> <!-- security:Certificate>d:\IdP/credentials/idp.crt</security:Certificate--></div><div> <!-- /security:Credential--></div></div><div>It seems we are not using the above lines in our configuration. but in "idp-metadata.xml" we have the certificate copied like below:</div><div> <IDPSSODescriptor protocolSupportEnumeration="urn:mace:shibboleth:1.0 urn:oasis:names:tc:SAML:1.1:protocol urn:oasis:names:tc:SAML:2.0:protocol"></div><div><div><KeyDescriptor></div><div> <ds:KeyInfo></div><div> <ds:X509Data></div><div> <ds:X509Certificate></div><div><br></div><div>YmcadfjgigAwIBAgIVAIpIZXcZKit2lLeQFAbgX+W9/whiMA0GCSqGSIb3DQEB</div><div>BQUAMBgxFjAUBgNVBAMTDWlkcC5zaGFycC5vcmcwHhcNMTMwNTIyMDg1OTMwWhcN</div><div>MzMwNTIyMDg1OTMwWjAYMRYwFAYDVQQDEw1pZHAuc2hhcnAub3JnMIIBIjANBgkq</div><div>hkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAiM3ExLSHpFizYTzXnv6P0brUIJ9NNFp4</div><div>6JIu3TFbmJXI9+Xu/0rJS91quJeUR1Nj6S5pug0858nSjOG/ce/pnxetVBxeI5en</div><div>umOPUwBjHMTN4x8Ju8OZVwR5nOOlOMCRIhbcdPy92QiNIQNvoVcg9kzt/xTkO6y6</div><div>cmcvaWRwL3NoaWJib2xldGgwHQYDVR0OBBYEFDZNh/kxh9MfDrDWrTYjrkyrKB9L</div><div>MA0GCSqGSIb3DQEBBQUAA4IBAQA3gsGr4s8cK9ym8ZZXxuFxVDqxUryeA0E7LSDO</div><div>2Z9ThTB51UxS4vgd4kyizQQaT7ZnyHG4Xiv0nwge1zpz5jER7fjzpT4ZlMO1j2vk</div><div>+vKkbeOicgxdeF9IIkbp7ruufVVjjveK9PRdYTf6nhQV5ExME7p094anhfeMeuIl</div><div>UCwUb+kDoVFeZ2YJe002DlUOM2I6tl3RdXcZ1EBM24pe9KTTLLw2WXDWXL5Yxy9l</div><div>hijzw/fm2P7ctqa/iIIqrqUZQXd5PdG42uMXhfsmO0B2pkC370Q4MibB/wjVt7e8</div><div>NYIMyebWf4LRO+Lxg2LFXqTs52ecMN8jD6Wjhfdjkhfjkdhfjhdkjfh</div><div><br></div><div> </ds:X509Certificate></div><div> </ds:X509Data></div><div> </ds:KeyInfo></div><div> </KeyDescriptor></div></div><div> </IDPSSODescriptor><br></div><div><br></div><div> <AttributeAuthorityDescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:1.1:protocol urn:oasis:names:tc:SAML:2.0:protocol"><br></div><div><div><KeyDescriptor></div><div> <ds:KeyInfo></div><div> <ds:X509Data></div><div> <ds:X509Certificate></div><div><br></div><div>YmcadfjgigAwIBAgIVAIpIZXcZKit2lLeQFAbgX+W9/whiMA0GCSqGSIb3DQEB</div><div>BQUAMBgxFjAUBgNVBAMTDWlkcC5zaGFycC5vcmcwHhcNMTMwNTIyMDg1OTMwWhcN</div><div>MzMwNTIyMDg1OTMwWjAYMRYwFAYDVQQDEw1pZHAuc2hhcnAub3JnMIIBIjANBgkq</div><div>hkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAiM3ExLSHpFizYTzXnv6P0brUIJ9NNFp4</div><div>6JIu3TFbmJXI9+Xu/0rJS91quJeUR1Nj6S5pug0858nSjOG/ce/pnxetVBxeI5en</div><div>umOPUwBjHMTN4x8Ju8OZVwR5nOOlOMCRIhbcdPy92QiNIQNvoVcg9kzt/xTkO6y6</div><div>cmcvaWRwL3NoaWJib2xldGgwHQYDVR0OBBYEFDZNh/kxh9MfDrDWrTYjrkyrKB9L</div><div>MA0GCSqGSIb3DQEBBQUAA4IBAQA3gsGr4s8cK9ym8ZZXxuFxVDqxUryeA0E7LSDO</div><div>2Z9ThTB51UxS4vgd4kyizQQaT7ZnyHG4Xiv0nwge1zpz5jER7fjzpT4ZlMO1j2vk</div><div>+vKkbeOicgxdeF9IIkbp7ruufVVjjveK9PRdYTf6nhQV5ExME7p094anhfeMeuIl</div><div>UCwUb+kDoVFeZ2YJe002DlUOM2I6tl3RdXcZ1EBM24pe9KTTLLw2WXDWXL5Yxy9l</div><div>hijzw/fm2P7ctqa/iIIqrqUZQXd5PdG42uMXhfsmO0B2pkC370Q4MibB/wjVt7e8</div><div>NYIMyebWf4LRO+Lxg2LFXqTs52ecMN8jD6Wjhfdjkhfjkdhfjhdkjfh</div><div><br></div><div> </ds:X509Certificate></div><div> </ds:X509Data></div><div> </ds:KeyInfo></div><div> </KeyDescriptor></div></div><div> </AttributeAuthorityDescriptor><br></div><div><br></div><div>As i know that the <ds:X509Certificate> is created by using OpenSSL and the same has copied over here.</div><div>but I think we are not using any of the idp.crt, idp.key file in our configuration. Is it the another way to configure like this without using idp.crt, idp.key files.</div><div><br></div><div><br></div><div>Thank you for your patience.</div></div><div class="gmail_extra"><br><div class="gmail_quote">On Fri, Mar 27, 2015 at 6:59 PM, Rod Widdowson <span dir="ltr"><<a href="mailto:rdw@steadingsoftware.com" target="_blank">rdw@steadingsoftware.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class="">> our certificate which is placed in idp-metadata.xml. I think we do not need to<br>
> upgrade shibboleth-idp.jar for this.<br>
<br>
</span>I think that was already answered. Java doesn't use OpenSSL. OpenSSL vulnerabilities will not affect java programs.<br>
<span class=""><br>
> I can able to see only the <ds:X:509 Certificate> certificate in the idp-metadata.xml except that i don't see any other keys(pvt key) in credentials folder<br>
<br>
</span>No idp.key file? Just the idp.crt file (with similar content to the metadata statement).<br>
<br>
What does relying-party.xml have to say about your credentials. Look for a line like this<br>
<br>
<security:Credential id="IdPCredential" xsi:type="security:X509Filesystem"><br>
<br>
That explicitly sets where the key and crt file are being served from.<br>
<div class="HOEnZb"><div class="h5"><br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
</div></div></blockquote></div><br></div>