<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<p>Thanks,</p>
<p>That's what I thought was the case but thought it best to check
first.</p>
<p>For info the appropriate paragraph from the standard is:</p>
<p>"</p>
<p class="Standard"><span
style="font-family:"Arial",sans-serif">In the case of
an X.509 certificate, there are no requirements as to the
content of the
certificate apart from the requirement that it contain the
appropriate public
key. Specifically, the certificate may be expired, not yet
valid, carry
critical or non-critical extensions or usage flags, and contain
any subject or
issuer. The use of the certificate structure is merely a matter
of notational
convenience to communicate a key and has no semantics in this
profile apart
from that. However, it is RECOMMENDED that certificates be
unexpired.</span></p>
<p class="Standard"><span
style="font-family:"Arial",sans-serif">"</span></p>
<p class="Standard"><span
style="font-family:"Arial",sans-serif">I'll feed this
back but also point out that other IdP implementations may
behave differently.</span></p>
<p class="Standard"><span
style="font-family:"Arial",sans-serif">Kind regards,</span></p>
<p class="Standard"><span
style="font-family:"Arial",sans-serif">Mark<br>
</span></p>
<div class="moz-cite-prefix">On 03/12/2020 14:16, Cantor, Scott
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:DM6PR01MB4076867B9C848541D7F581DBD0F20@DM6PR01MB4076.prod.exchangelabs.com">
<blockquote type="cite">
<pre class="moz-quote-pre" wrap="">Does the IdP do any validity checking of certificates or does it simply ignore the
expiry data?
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">
No. What we do is exactly what's defined in the standard.
<a class="moz-txt-link-freetext" href="https://wiki.oasis-open.org/security/SAML2MetadataIOP">https://wiki.oasis-open.org/security/SAML2MetadataIOP</a>
Unless you only care about Shibboleth IdPs, that's not going to matter much.
-- Scott
</pre>
</blockquote>
</body>
</html>