<div dir="ltr">If I have a software product that runs on a server, and this product consists of multiple services that provide their own login to a user, does each SP need its own public/private key pair? Like for example, if I have the following servers:<br><br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><a href="https://mySP.awesome.net">https://mySP.awesome.net</a><br><a href="https://myOtherSP.awesome.net">https://myOtherSP.awesome.net</a></blockquote><br><div>So the first server has the following sources of metadata:<br><br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><a href="https://mySP.awesome.net/rest/v2/sso/messege/shibboleth/metadata">https://mySP.awesome.net/rest/v2/sso/messege/shibboleth/metadata</a><br><span style="font-size:small;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial;float:none;display:inline"><a href="https://mySP.awesome.net/rest/v2/sso/admin/shibboleth/metadata">https://mySP.awesome.net/rest/v2/sso/admin/shibboleth/metadata</a><br></span><span style="font-size:small;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial;float:none;display:inline"><span style="text-decoration-style:initial;text-decoration-color:initial;float:none;display:inline"><a href="https://mySP.awesome.net/rest/v2/sso/mobileclient/shibboleth/metadata">https://mySP.awesome.net/rest/v2/sso/mobileclient/shibboleth/metadata</a><br></span></span><span style="font-size:small;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial;float:none;display:inline"><span style="text-decoration-style:initial;text-decoration-color:initial;float:none;display:inline"><span style="font-size:small;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial;float:none;display:inline"><a href="https://mySP.awesome.net/rest/v2/sso/othermobileclient/shibboleth/metadata">https://mySP.awesome.net/rest/v2/sso/othermobileclient/shibboleth/metadata</a></span></span></span></blockquote><div><br></div><div>And the second server would have the same. For each server, does each SP need its own unique public cert in its metadata or can the SPs on one server share just one public/private key pair?  </div><div><br></div></div></div>