Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

When accepting public keys from someone setting up an identity provider for access to resources protected by a service provider using SAML 2.0, do you absolutely need to have a unique certificate? Is this covered in the SAML specifications?

If they don't, I assume that use of certificates as a layer of defense is rendered void. An example might be someone setting up a test IdP and reusing the certificate for production.

share|improve this question

2 Answers 2

It is not specified that the certificates for two idps must be unique. As far as I know you dont even have to have a certificate. But its recommended.

share|improve this answer

To expand on Stefan's answer:

I would also ensure that the certificate used for signing is different than the one used for encryption, as well as different from the one the TLS (I hope you aren't still using SSL) is using to secure the communications channel.

In other words... A unique certificate for each thing.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.