Differences
This shows you the differences between two versions of the page.
Both sides previous revision Previous revision Next revision | Previous revision Next revisionBoth sides next revision | ||
en:certificates [2019/03/21 10:07] – [Self-signed Certificates] Wolfgang Pempe | en:certificates [2019/07/24 12:54] – [Information for Service Providers] Wolfgang Pempe | ||
---|---|---|---|
Line 1: | Line 1: | ||
- | ====== Certificates for SAML-based communication | + | ~~NOTOC~~ |
+ | ====== Certificates ====== | ||
+ | {{INLINETOC 2}} | ||
+ | ===== Certificates for SAML-based communication ===== | ||
In the context of SAML-based communication between IdP and SP, certificates are used for purposes of signature validation and encryption. Those certificates must be registered for the respective entity using the [[en: | In the context of SAML-based communication between IdP and SP, certificates are used for purposes of signature validation and encryption. Those certificates must be registered for the respective entity using the [[en: | ||
**The general rule is:** Entities with invalid (i.e. expired or revoked) certificates are automatically removed from the productive DFN-AAI federation! | **The general rule is:** Entities with invalid (i.e. expired or revoked) certificates are automatically removed from the productive DFN-AAI federation! | ||
- | ===== Information for Identity Providers / Attribute Authorities | + | ==== Information for Identity Providers / Attribute Authorities ==== |
Cf. [[de: | Cf. [[de: | ||
- | ===== Information for Service Providers | + | ==== Information for Service Providers ==== |
- | All certificates and the respective private keys used for SAML-based communication have to be added to your SP's configuration, | + | All certificates and the respective private keys used for SAML-based communication have to be added to your SP's configuration, |
- | ==== DFN-PKI Certificates ==== | + | === DFN-PKI Certificates === |
+ | For general information, | ||
If you are entitled to request certificates issued by DFN-PKI, please select the " | If you are entitled to request certificates issued by DFN-PKI, please select the " | ||
- | ==== Common Trusted CA Certificates | + | === Common Trusted CA Certificates === |
- | You can use certificates issued by common Certification Authorities (CAs) that are preinstalled in the most common web browsers (Google Chrome, Firefox, Microsoft Edge). They must not exceed a validity of 39 months. If you get an " | + | You can use certificates issued by common Certification Authorities (CAs) that are preinstalled in the most common web browsers (Google Chrome, Firefox, Microsoft Edge). They must not exceed a validity of 39 months. If you get an " |
- | ==== Self-signed Certificates | + | === Self-signed Certificates === |
Self-signed certificates may be used as well if they are not valid for longer than 39 months. For production, the CN (or the subject alternative names) of the certificate must at least contain the domain name of the SP. Ideally it should contain the complete host name. As for the technical details, please refer to the online documentation of [[https:// | Self-signed certificates may be used as well if they are not valid for longer than 39 months. For production, the CN (or the subject alternative names) of the certificate must at least contain the domain name of the SP. Ideally it should contain the complete host name. As for the technical details, please refer to the online documentation of [[https:// | ||
* Please offer us a possibility to download the certificate via https (e.g. via your SPs metadata handler or a download link to the file on your webserver). The SSL connection to the webserver has to be secured by a trusted CA certificate. | * Please offer us a possibility to download the certificate via https (e.g. via your SPs metadata handler or a download link to the file on your webserver). The SSL connection to the webserver has to be secured by a trusted CA certificate. | ||
Line 26: | Line 30: | ||
<callout type=" | <callout type=" | ||
- | **As for Service Providers that are already registered with another federation, the same certificate (i.e. the one registered with the other federation) may be used even if the aforementioned requirements are not met.** In this case, please drop a note to the DFN-AAI [[mailto:hotline@aai.dfn.de|helpdesk]]. | + | **As for Service Providers that are already registered with another federation, the same certificate (i.e. the one registered with the other federation) may be used even if the aforementioned requirements are not met.** In this case, please drop a note to the DFN-AAI [[hotline@aai.dfn.de|helpdesk]]. |
</ | </ | ||
- | ==== Please avoid the following certificates | + | === Please avoid the following certificates === |
- | === Wildcard certificates | + | == Wildcard certificates == |
The use of wildcard certificates is only permitted in duly justified cases. | The use of wildcard certificates is only permitted in duly justified cases. | ||
- | === Letsencrypt | + | == Letsencrypt == |
We strongly advise against the use of Letsencrypt certificates for SAML-based communication as they expire after 90 days. Every time, you would have to do a manual certificate rollover in the metadata administration tool. The SP configuration has to be adapted twice for a rollover, too. That is why we recommend self-signed certificates with a validity of 3 years. (If you are securing your webserver with Letsencrypt certificates, | We strongly advise against the use of Letsencrypt certificates for SAML-based communication as they expire after 90 days. Every time, you would have to do a manual certificate rollover in the metadata administration tool. The SP configuration has to be adapted twice for a rollover, too. That is why we recommend self-signed certificates with a validity of 3 years. (If you are securing your webserver with Letsencrypt certificates, | ||
- | ==== Certificate rollover | + | === Certificate rollover === |
Whenever you switch to a new certificate, | Whenever you switch to a new certificate, | ||
**Next step:** [[en: | **Next step:** [[en: | ||
- | ====== The SSL certificate chain on your webserver | + | ===== The SSL certificate chain on your webserver ===== |
Your webserver' | Your webserver' | ||