The following signing certificate (public key) is issued for the Production environment. If you are looking for the the preview environment key, see Metadata signing key for the Preview environment.

The MDQ Service uses a different key from the legacy InCommon metadata aggregate.

This is not the same certificate that was used for the legacy aggregates from md.incommon.org or from the preview service. Please make sure you update your configurations accordingly.

Certificate Fingerprint:

SHA512 Fingerprint=B8:F1:0E:E6:B5:47:DC:D3:15:69:2C:1F:D8:E0:70:3D:1D:CC:E6:12:77:84:80:63:8B:8F:DB:FC:30:97:30:2C:7C:17:C0:CF:C7:90:51:B2:5D:BB:3A:50:8F:9A:EF:6B:0B:21:8B:A2:4D:B3:DF:0A:00:6B:E6:CD:13:EE:E6:3F

SHA384 Fingerprint=36:5E:2F:4D:BA:6B:71:3C:53:89:91:83:59:CB:82:E6:83:15:69:14:12:D1:3E:03:2E:61:96:63:A8:D5:0D:8A:80:8B:C1:37:E2:09:A7:E1:F0:CC:C0:D7:8B:53:7A:5A

SHA256 Fingerprint=60:49:74:D6:1F:E0:D7:F4:D6:3D:6C:8D:B9:8A:85:7E:64:2A:B9:B4:70:E3:E8:5D:D5:4D:66:3D:04:96:F9:00

SHA1 Fingerprint=F8:4E:F8:47:EF:BB:EE:47:86:32:DB:94:17:8A:31:A6:94:73:19:36

Certificate download locations:

Certificate:

inc-md-cert-mdq.pem

Verifying the Certificate and Metadata

You may check the integrity of the downloaded certificate in a variety of ways. For example, on a GNU/Linux system, you could use curl and openssl to perform the first two steps of the bootstrap process:

# Step 1: Grab a copy of the certificate
 
# Step 2: Compute various fingerprints of the metadata signing certificate
$ openssl x509 -sha1 -noout -fingerprint -in inc-md-cert-mdq.pem
SHA1 Fingerprint=F8:4E:F8:47:EF:BB:EE:47:86:32:DB:94:17:8A:31:A6:94:73:19:36


$ openssl x509 -sha256 -noout -fingerprint -in inc-md-cert-mdq.pem
SHA256 Fingerprint=60:49:74:D6:1F:E0:D7:F4:D6:3D:6C:8D:B9:8A:85:7E:64:2A:B9:B4:70:E3:E8:5D:D5:4D:66:3D:04:96:F9:00


$ openssl x509 -sha384 -noout -fingerprint -in inc-md-cert-mdq.pem
SHA384 Fingerprint=36:5E:2F:4D:BA:6B:71:3C:53:89:91:83:59:CB:82:E6:83:15:69:14:12:D1:3E:03:2E:61:96:63:A8:D5:0D:8A:80:8B:C1:37:E2:09:A7:E1:F0:CC:C0:D7:8B:53:7A:5A


$ openssl x509 -sha512 -noout -fingerprint -in inc-md-cert-mdq.pem
SHA512 Fingerprint=B8:F1:0E:E6:B5:47:DC:D3:15:69:2C:1F:D8:E0:70:3D:1D:CC:E6:12:77:84:80:63:8B:8F:DB:FC:30:97:30:2C:7C:17:C0:CF:C7:90:51:B2:5D:BB:3A:50:8F:9A:EF:6B:0B:21:8B:A2:4D:B3:DF:0A:00:6B:E6:CD:13:EE:E6:3F


# Step 3: Compare against fingerprints at the top of the page.

You can also check downloaded metadata against the signing cert for validity. You will need to first download xmlsectool here: http://shibboleth.net/downloads/tools/xmlsectool/

# Step 1: Download some metadata from MDQ
$ curl -s -o internet2-idp-metadata.xml http://mdq.incommon.org/entities/urn:mace:incommon:internet2.edu

# Step 2: Compare the metadata against the singing cert using xmlsectool
$ xmlsectool.sh --verifySignature --certificate inc-md-cert-mdq.pem --inFile internet2-idp-metadata.xml


<Output goes here>


### If the cert is invalid, you will see output different from above, example:
# INFO  XMLSecTool - Reading XML document from file 'metadata.xml'
# INFO  XMLSecTool - XML document parsed and is well-formed.
# ERROR XMLSecTool - XML document signature verification failed with an error
# org.apache.xml.security.signature.XMLSignatureException: Signature length not correct: got 256 but was expecting 384

More information on xmlsectool is available here: https://wiki.shibboleth.net/confluence/display/XSTJ2/xmlsectool+V2+Home

Page tree

production metadata signing key