Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revision Previous revision
en:certificates [2019/07/11 16:48]
Wolfgang Pempe [DFN-PKI Certificates]
en:certificates [2019/07/11 17:06] (current)
Wolfgang Pempe
Line 1: Line 1:
-====== Certificates for SAML-based communication ​======+~~NOTOC~~ 
 +====== Certificates ====== 
 +{{INLINETOC 2}} 
 +===== Certificates for SAML-based communication =====
 In the context of SAML-based communication between IdP and SP, certificates are used for purposes of signature validation and encryption. Those certificates must be registered for the respective entity using the [[en:​metadata_admin_tool|metadata administration tool]]. In the context of SAML-based communication between IdP and SP, certificates are used for purposes of signature validation and encryption. Those certificates must be registered for the respective entity using the [[en:​metadata_admin_tool|metadata administration tool]].
  
 **The general rule is:** Entities with invalid (i.e. expired or revoked) certificates are automatically removed from the productive DFN-AAI federation! **The general rule is:** Entities with invalid (i.e. expired or revoked) certificates are automatically removed from the productive DFN-AAI federation!
-===== Information for Identity Providers / Attribute Authorities ​=====+==== Information for Identity Providers / Attribute Authorities ====
 Cf. [[de:​shibidp3prepare-zert#​dfn-pki-zertifikate|Vorbereitung:​ Zertifikate]] Cf. [[de:​shibidp3prepare-zert#​dfn-pki-zertifikate|Vorbereitung:​ Zertifikate]]
  
-===== Information for Service Providers ​=====+==== Information for Service Providers ====
 All certificates and the respective private keys used for SAML-based communication have to be added to your SP's configuration,​ no matter which of the options mentioned below you choose. With Shibboleth SP this is the ''​CredentialResolver''​ element in /​etc/​shibboleth/​shibboleth2.xml (see [[https://​wiki.aai.dfn.de/​de:​shibsp|Shibboleth SP (de)]]). All certificates and the respective private keys used for SAML-based communication have to be added to your SP's configuration,​ no matter which of the options mentioned below you choose. With Shibboleth SP this is the ''​CredentialResolver''​ element in /​etc/​shibboleth/​shibboleth2.xml (see [[https://​wiki.aai.dfn.de/​de:​shibsp|Shibboleth SP (de)]]).
  
-==== DFN-PKI Certificates ​====+=== DFN-PKI Certificates ===
 For general information,​ please refer to https://​www.pki.dfn.de/​dfn-aai-zertifikate/​ \\ For general information,​ please refer to https://​www.pki.dfn.de/​dfn-aai-zertifikate/​ \\
 If you are entitled to request certificates issued by DFN-PKI, please select the "​Shibboleth IdP SP" profile when submitting your CSR. Upload the server certificate in the metadata administration tool. If you are entitled to request certificates issued by DFN-PKI, please select the "​Shibboleth IdP SP" profile when submitting your CSR. Upload the server certificate in the metadata administration tool.
  
-==== Common Trusted CA Certificates ​====+=== Common Trusted CA Certificates ===
 You can use certificates issued by common Certification Authorities (CAs) that are preinstalled in the most common web browsers (Google Chrome, Firefox, Microsoft Edge). They must not exceed a validity of 39 months. If you get an "​Issuer not found" warning for such a certificate please contact our [[mailto:​hotline@aai.dfn.de|helpdesk]]. ​ You can use certificates issued by common Certification Authorities (CAs) that are preinstalled in the most common web browsers (Google Chrome, Firefox, Microsoft Edge). They must not exceed a validity of 39 months. If you get an "​Issuer not found" warning for such a certificate please contact our [[mailto:​hotline@aai.dfn.de|helpdesk]]. ​
  
-==== Self-signed Certificates ​====+=== Self-signed Certificates ===
 Self-signed certificates may be used as well if they are not valid for longer than 39 months. For production, the CN (or the subject alternative names) of the certificate must at least contain the domain name of the SP. Ideally it should contain the complete host name. As for the technical details, please refer to the online documentation of [[https://​www.switch.ch/​aai/​guides/​sp/​configuration/#​4|SWITCHaai]]. Before joining the DFN-AAI production federation, self-signed certificates have to be verified by the DFN-AAI operations team. For this purpose, the following options are available after you uploaded your certificate in the metadata administration tool: Self-signed certificates may be used as well if they are not valid for longer than 39 months. For production, the CN (or the subject alternative names) of the certificate must at least contain the domain name of the SP. Ideally it should contain the complete host name. As for the technical details, please refer to the online documentation of [[https://​www.switch.ch/​aai/​guides/​sp/​configuration/#​4|SWITCHaai]]. Before joining the DFN-AAI production federation, self-signed certificates have to be verified by the DFN-AAI operations team. For this purpose, the following options are available after you uploaded your certificate in the metadata administration tool:
   * Please offer us a possibility to download the certificate via https (e.g. via your SPs metadata handler or a download link to the file on your webserver). The SSL connection to the webserver has to be secured by a trusted CA certificate.   * Please offer us a possibility to download the certificate via https (e.g. via your SPs metadata handler or a download link to the file on your webserver). The SSL connection to the webserver has to be secured by a trusted CA certificate.
Line 30: Line 33:
 </​callout>​ </​callout>​
  
-==== Please avoid the following certificates ​==== +=== Please avoid the following certificates === 
-=== Wildcard certificates ​===+== Wildcard certificates ==
 The use of wildcard certificates is only permitted in duly justified cases. The use of wildcard certificates is only permitted in duly justified cases.
  
-=== Letsencrypt ​===+== Letsencrypt ==
 We strongly advise against the use of Letsencrypt certificates for SAML-based communication as they expire after 90 days. Every time, you would have to do a manual certificate rollover in the metadata administration tool. The SP configuration has to be adapted twice for a rollover, too. That is why we recommend self-signed certificates with a validity of 3 years. (If you are securing your webserver with Letsencrypt certificates,​ that is obviously no problem.) ​ We strongly advise against the use of Letsencrypt certificates for SAML-based communication as they expire after 90 days. Every time, you would have to do a manual certificate rollover in the metadata administration tool. The SP configuration has to be adapted twice for a rollover, too. That is why we recommend self-signed certificates with a validity of 3 years. (If you are securing your webserver with Letsencrypt certificates,​ that is obviously no problem.) ​
  
-==== Certificate rollover ​====+=== Certificate rollover ===
 Whenever you switch to a new certificate,​ both the old and the new one are temporarily part of the federation'​s metadata. We recommend the documentation of [[https://​www.switch.ch/​aai/​support/​certificates/​certificate-migration/​|SWITCHaai]]. (When their documentation tells you to wait two hours, you should wait a whole day as the distribution of metadata to all DFN-AAI participants can take that long. If you have a DFN-PKI certificate,​ replace their referrals to self-signed certificates with the DFN-PKI certificate.) Whenever you switch to a new certificate,​ both the old and the new one are temporarily part of the federation'​s metadata. We recommend the documentation of [[https://​www.switch.ch/​aai/​support/​certificates/​certificate-migration/​|SWITCHaai]]. (When their documentation tells you to wait two hours, you should wait a whole day as the distribution of metadata to all DFN-AAI participants can take that long. If you have a DFN-PKI certificate,​ replace their referrals to self-signed certificates with the DFN-PKI certificate.)
  
 **Next step:** [[en:​functionaltest|Functional Tests]] **Next step:** [[en:​functionaltest|Functional Tests]]
  
-====== The SSL certificate chain on your webserver ​======+===== The SSL certificate chain on your webserver =====
 Your webserver'​s SSL configuration is not directly affected by the configuration of SAML-based communication in DFN-AAI. That said, the webserver still has to deliver a valid certificate chain: The binding URLs are secured by SSL/TLS as well as the IdP/SP websites. If end users' devices validate the certificate chain they will encounter errors on your site. Android devices, for example, will not trust the connection. With Shibboleth IdPs, you can verify it by calling the status page (https://​idp.domain.tld/​idp/​status). With Shibboleth SPs, we recommend to check the Session Handler (https://​sp.domain.tld/​Shibboleth.sso/​Session). Your webserver'​s SSL configuration is not directly affected by the configuration of SAML-based communication in DFN-AAI. That said, the webserver still has to deliver a valid certificate chain: The binding URLs are secured by SSL/TLS as well as the IdP/SP websites. If end users' devices validate the certificate chain they will encounter errors on your site. Android devices, for example, will not trust the connection. With Shibboleth IdPs, you can verify it by calling the status page (https://​idp.domain.tld/​idp/​status). With Shibboleth SPs, we recommend to check the Session Handler (https://​sp.domain.tld/​Shibboleth.sso/​Session).
  
  • Last modified: 6 days ago