<div dir="ltr"><div>I am trying to upgrade the browser-facing certificate on the Service Provider (sp). I have generated a new certificate which includes a domain certificate and an intermediate certificate. I have combined both the certificates into a single file in pem format.<div><br></div><div>Then I have updated shibboleth2.xml (after notifying all the stakeholders about the change) to point to the new certificate:</div><div><br></div><div>However I have couple of questions how to update the sp-metadata.xml with the new certificate: </div><div><br></div><div><br></div><div>1. Do I really have to provide both domain and intermediate certificate details or the domain certificate should be enough for IdPs to connect to the my sp?</div><div><br></div><div>2. If both the certificates are required, how should my sp-metadata.xml look like among the following options ?</div><div><br></div><div>(a) Multiple <ds:X509Certificate> elements within same <ds:KeyInfo> element</div><div><ds:KeyInfo xmlns:ds="<a href="http://www.w3.org/2000/09/xmldsig#">http://www.w3.org/2000/09/xmldsig#</a>"></div><div style="margin-left:40px!important">            <ds:KeyName>key-name</ds:KeyName></div></div><div style="margin-left:40px!important">           <ds:X509Data></div><div style="margin-left:80px!important">                 <ds:X509SubjectName>domain-name</ds:X509SubjectName></div><div style="margin-left:80px!important">            <ds:X509Certificate>domain-certificate</ds:X509Certificate></div><div style="margin-left:80px!important">             <ds:X509Certificate>intermediate-certificate</ds:X509Certificate></div><div style="margin-left:40px!important">       </ds:X509Data></div><div><div></ds:KeyInfo></div><div><br></div><div>(b) Multiple <ds:KeyInfo> elements</div><div><ds:KeyInfo xmlns:ds="<a href="http://www.w3.org/2000/09/xmldsig#">http://www.w3.org/2000/09/xmldsig#</a>"></div></div><div style="margin-left:40px!important">       <ds:KeyName>domain-key-name</ds:KeyName></div><div style="margin-left:40px!important">        <ds:X509Data></div><div style="margin-left:80px!important">                 <ds:X509SubjectName>domain-name</ds:X509SubjectName></div><div style="margin-left:80px!important">            <ds:X509Certificate>domain-certificate</ds:X509Certificate></div><div style="margin-left:40px!important">     </ds:X509Data></div><div><div></ds:KeyInfo></div><div><ds:KeyInfo xmlns:ds="<a href="http://www.w3.org/2000/09/xmldsig#">http://www.w3.org/2000/09/xmldsig#</a>"></div></div><div style="margin-left:40px!important">       <ds:KeyName>intermediate-key-name</ds:KeyName></div><div style="margin-left:40px!important">          <ds:X509Data></div><div style="margin-left:80px!important">                 <ds:X509SubjectName>intermediate-name</ds:X509SubjectName></div><div style="margin-left:80px!important">              <ds:X509Certificate>intermediate-certificate</ds:X509Certificate></div><div style="margin-left:40px!important">       </ds:X509Data></div><div><div></ds:KeyInfo></div><div><br></div><div><br></div><div>I have also raise the question in Stack Overflow (<a href="http://stackoverflow.com/questions/38054193/saml2-upgrade-sp-with-intermediate-certificate">http://stackoverflow.com/questions/38054193/saml2-upgrade-sp-with-intermediate-certificate</a>)</div><div><br></div><div>Thanks in advance.</div><div><br></div></div></div>