Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

  • A potential federation partner (especially a partner not using the Shibboleth software) may question the use of self-signed certificates. As discussed in the Background section, there are, in fact, fewer interoperability issues with self-signed certificates compared to CA-signed certificates.
  • Wiki Markup
    The Shibboleth software does not check the expiration dates of certificates \[4\], but *expired certificates often cause interoperability issues* with other software and with some versions of Apache used in the deployment of the Shibboleth IdP. InCommon recommends that you plan ahead and migrate to an unexpired certificate well ahead of your certificate's expiration date. See the section on [Key Rollover|#Key-Rollover] below.
  • For key management purposes, InCommon allows multiple certificates per role descriptor at any time. (You can log in to the site administration tool, select a particular role, and associate more than one certificate with that fole role for the purposes of migrating from one certificate to another.) Bear in mind, however, that some SAML implementations do not support multiple keys properly and you may want to test this capability with your non-Shibboleth partners. For example:
    • EZProxy is known to ignore additional keys beyond the first.
    • AD FS 2.0 will not consume an <md:EntityDescriptor> element containing more than one encryption key.
  • Some implementations (e.g., AD FS 2.0) do not allow the same certificate to be used by two different entities.
  • If the certificate will be used for TLS/SSL server authentication, the certificate's CN (and/or subjectAltName) value should match the server's hostname. This is especially true for IdPs but may also be true in certain advanced scenarios where the SP acts as a SOAP responder.
  • Avoid certificates with special certificate extensions, since some implementations will actually try to use them. For example, AD FS 2.0 will attempt to access the CRL at the location given in the CRL Distribution Point certificate extension.

...