<div dir="ltr">> <span style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:12.8px;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial;float:none;display:inline">for decrypting encrypted assertions</span><div><span style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:12.8px;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial;float:none;display:inline"><br></span></div><div><span style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:12.8px;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial;float:none;display:inline">So it's used when the ExplicitKey trust engine is in use, then?  Should I continue to generate certs for my SPs, then?</span></div><div><br></div><div>Is the usage outlined at <a href="https://stackoverflow.com/questions/8276233/is-it-recommended-to-sign-and-encrypt-saml-and-use-ssl">https://stackoverflow.com/questions/8276233/is-it-recommended-to-sign-and-encrypt-saml-and-use-ssl</a> correct that ultimately it's used to endure the assertions are not modified in flight, so a self-signed cert is fine?</div></div><div class="gmail_extra"><br clear="all"><div><div class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div><span style="font-size:12.8px">--Tom Noonan II</span><br></div></div></div></div></div></div>
<br><div class="gmail_quote">On Wed, Feb 28, 2018 at 4:34 PM, Cantor, Scott <span dir="ltr"><<a href="mailto:cantor.2@osu.edu" target="_blank">cantor.2@osu.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">> - If no TrustEngine is specified the ExplicitKey engine is tried, and then the<br>
> PKIX engine<br>
> (<a href="https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPTrustEngine" rel="noreferrer" target="_blank">https://wiki.shibboleth.net/<wbr>confluence/display/SHIB2/<wbr>NativeSPTrustEngine</a><br>
> <<a href="https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPTrustEngine" rel="noreferrer" target="_blank">https://wiki.shibboleth.net/<wbr>confluence/display/SHIB2/<wbr>NativeSPTrustEngine</a><br>
> > )<br>
> - The CredentialResolver config is used by the StaticPKIX engine.<br>
<br>
That's how the SP works internally, it has nothing to with what your key is used for. The IdP however has the same logic generally speaking and an SP key used for signing is handled the same way. Encryption is something else entirely and an SP key is normally used for both (or more accurately labeled as both but is in fact used for encryption only as there is no substantial use of signing or TLS anymore in the SP as deployed by most).<br>
<br>
> I'm still not clear on how the CredentialResolver certificate is used.<br>
<br>
Signing AuthnRequests, client TLS for attribute queries or artifact lookup, and for decrypting encrypted assertions. Only the latter is common anymore.<br>
<span class="HOEnZb"><font color="#888888"><br>
-- Scott<br>
<br>
<br>
--<br>
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg" rel="noreferrer" target="_blank">https://wiki.shibboleth.net/<wbr>confluence/x/coFAAg</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.<wbr>net</a><br>
</font></span></blockquote></div><br></div>