<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
Brandon,
<div class=""><br class="">
</div>
<div class="">
<div>
<blockquote type="cite" class="">
<div class="">
<div id="divtagdefaultwrapper" style="font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; font-size: 12pt; background-color: rgb(255, 255, 255); font-family: Calibri, Arial, Helvetica, sans-serif;" class="">
That helps tremendously. I have been testing with the fingerprint of my encryption certificate. In the service it says the SHA-1 is the encryption<span class="Apple-converted-space"> </span><i class="">and<span class="Apple-converted-space"> </span></i>signing
certificate.</div>
</div>
</blockquote>
<div><br class="">
</div>
<div>It’s possible to use different certificates for encryption and signature. It wasn’t a common case prior to the release of IdPv3, but I think they were probably trying to accommodate that. As an IdP, your signing certificate is almost always the relevant
one.</div>
<br class="">
<blockquote type="cite" class="">
<div class="">
<div id="divtagdefaultwrapper" style="font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; font-size: 12pt; background-color: rgb(255, 255, 255); font-family: Calibri, Arial, Helvetica, sans-serif;" class="">
Does this mean in the metadata I include both xml objects to link signature and encryption as the same values as my X.509 signing certificate?</div>
</div>
</blockquote>
<div><br class="">
</div>
<div>If I were to guess and reword this as “does this mean that I should enter my signing certificate’s SHA-1 hash into the fields on their webpage”, then I would say yes. I’m not quite sure how to interpret your question as stated.</div>
<br class="">
<blockquote type="cite" class="">
<div class="">
<div id="divtagdefaultwrapper" style="font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; font-size: 12pt; background-color: rgb(255, 255, 255); font-family: Calibri, Arial, Helvetica, sans-serif;" class="">
In other words, I tell my metadata-less friends about my encryption and singing certificates but they are both actually the cat of my signing certificate.</div>
</div>
</blockquote>
<div><br class="">
</div>
<div>Well, the hash isn’t just the entire base64-encoded printed raw value. It’s a specific field. You can find that field using tools like openssl.</div>
<br class="">
<blockquote type="cite" class="">
<div class="">
<div id="divtagdefaultwrapper" style="font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; font-size: 12pt; background-color: rgb(255, 255, 255); font-family: Calibri, Arial, Helvetica, sans-serif;" class="">
My browser certificate will be different than my IDP certificate. I am behind a load balancer that provides https certs, is this a problem?<span class="Apple-converted-space"> </span><br class="">
</div>
</div>
</blockquote>
</div>
<br class="">
</div>
<div class="">No, generally it’s a good thing because it gives you more flexibility in management of each certificate and won’t need to roll over your IdP certificate with frequency. It’s a deployment decision, though.</div>
<div class=""><br class="">
</div>
<div class="">Take care,</div>
<div class="">Nate.</div>
</body>
</html>