Hi RSK Team.
Currently SpOptions.EncryptionCertificate accepts a single X509Certificate2 for decrypting encrypted SAML assertions. This makes encryption certificate rotation extremely difficult in multi-federation environments.
The only way to rotate the encryption certificate today is:
- Disable RequireEncryptedAssertions for all identity providers
- Ask all partners to stop encrypting assertions
- Wait for confirmation from every partner
- Replace the certificate
- Ask all partners to update their metadata and start encrypting again
- Re-enable RequireEncryptedAssertions
This requires coordination across potentially dozens of external partners which is operationally infeasible and introduces a security window where assertions are transmitted unencrypted.
Proposed solution: Keep the existing SpOptions.EncryptionCertificate as the active decryption certificate (also published in SP metadata for partners to encrypt with), and add a new property such as ICollection DecommissionedDecryptionCertificates for previously active certificates that should still be accepted as a fallback during the transition period. The library would first attempt decryption with the active EncryptionCertificate, and if that fails, try each decommissioned certificate. This enables graceful rotation.
Hi RSK Team.
Currently SpOptions.EncryptionCertificate accepts a single X509Certificate2 for decrypting encrypted SAML assertions. This makes encryption certificate rotation extremely difficult in multi-federation environments.
The only way to rotate the encryption certificate today is:
This requires coordination across potentially dozens of external partners which is operationally infeasible and introduces a security window where assertions are transmitted unencrypted.
Proposed solution: Keep the existing SpOptions.EncryptionCertificate as the active decryption certificate (also published in SP metadata for partners to encrypt with), and add a new property such as ICollection DecommissionedDecryptionCertificates for previously active certificates that should still be accepted as a fallback during the transition period. The library would first attempt decryption with the active EncryptionCertificate, and if that fails, try each decommissioned certificate. This enables graceful rotation.