Please note

This documentation is taken from https://help.switch.ch/aai/guides/sp/certificate-rollover/ (opens in new tab). You can perform an interactive configuration of the ServiceProvider there.

On this page, you will learn how to perform a certificate rollover with the Shibboleth ServiceProvider. This has the advantage that there is no downtime when you swap certificates.

This requires that you operate a Shibboleth ServiceProvider with the official packages from the Shibboleth Consortium (see Installation).

Step 1
To do this, first request a certificate from the DFN-Verein Community PKI. Once you have received it, edit the CredentialResolver in the file /etc/shibboleth/shibboleth2.xml as follows:

       <!-- 
        Certificate/Private key pairs are read in sequence.
        Unless specificially defined only the first 
        CredentialResolver is used for attribute requests.
        More information:
        https://wiki.shibboleth.net/confluence/display/SP3/CredentialResolver
        -->
        <CredentialResolver type="Chaining">
             <!-- Active certificate -->
             <CredentialResolver type="File"
                                 key="/etc/shibboleth/sp-key.pem" 
                                 certificate="/etc/shibboleth/sp-cert.pem"/>
             <!-- Additional new certificate -->
             <CredentialResolver type="File"
                                 key="/etc/shibboleth/sp-key-2025.pem" 
                                 certificate="/etc/shibboleth/sp-cert-2025.pem"/>
        </CredentialResolver>

Please note that the permissions for the certificate/key pair must be correct. The Shibboleth ServiceProvider usually runs under the user and group shibd.

Step 2
After making the change, check the configuration using “shibd -t.” No errors should occur.

Step 3
Next, restart the service using “systemctl restart shibd”. Now both the old and new certificates are active.

Step 4 
Add the new certificate in the ServiceProviderManager.

Step 5 
Inform us of the upcoming certificate change by sending an email to (Send an email to:) servicedesk@itc.rwth-aachen.de.

The metadata with the new, additional certificate will then be updated shortly and the status in the ServiceProviderManager will change from “requested” to “productive.” From this point on, both certificates will be valid.

Step 6
Once the status has changed in ServiceProviderManager or you have been notified of the switch by email, you can swap the order again. This time, the new certificate comes first and the old certificate second:

        <!-- 
        Certificate/Private key pairs are read in sequence.
        Unless specificially defined only the first 
        CredentialResolver is used for attribute requests.
        More information:
        https://wiki.shibboleth.net/confluence/display/SP3/CredentialResolver
        -->
        <CredentialResolver type="Chaining">
             <!-- Active certificate -->
             <CredentialResolver type="File"
                                 key="/etc/shibboleth/sp-key-2025.pem" 
                                 certificate="/etc/shibboleth/sp-cert-2025.pem"/>
             <!-- Additional old certificate -->
             <CredentialResolver type="File"
                                 key="/etc/shibboleth/sp-key.pem" 
                                 certificate="/etc/shibboleth/sp-cert.pem"/>
             
        </CredentialResolver>

Step 7
Check again that everything is OK using “shibd -t”.

Step 8
Restart the service using “systemctl restart shibd”.

Step 9
Remove the old certificate completely in the ServiceProviderManager.

Step 10
Inform us by sending an email to (Send an email to:) servicedesk@itc.rwth-aachen.de so that the metadata can be adjusted.

Step 11
Once the change is complete, you can remove the old certificate from shibboleth2.xml.