Is it possible to have two x.509 certificates for one domain

[moje2920]

Hi everyone,

I am currently working on a Idp project. There are two SPs in the same domain , but these two SPs are using different X.509 certificates. Is it possible for picketlink to allow it?

For example, first SP with issuer domain : www.abc.com/sp1 and another is www.abc.com/sp2, but they are using different X.509 certificate. Does Picketlink support this scenario?

   <ValidatingAlias Key="localhost" Value="T_SAML_Digital_Sig" />

<ValidatingAlias Key="www.abc.com/sp1" Value="key1_cp_x509" />

<ValidatingAlias Key="www.abc.com/sp2" Value="key2_cp_x509" />

Thanks,

LG

[pcraveiro]

Hey Lg chen,

    Yes, as long as your IdP is trusting the certificates from both SPs.

Regards.

[moje2920]

Hi Pedro,

However, it didn't really work with the following setting. Could you advise if there's any other setting we might need in order to realize it?

  <ValidatingAlias Key="localhost" Value="T_SAML_Digital_Sig" />

<ValidatingAlias Key="www.abc.com/sp1" Value="key1_cp_x509" />

<ValidatingAlias Key="www.abc.com/sp2" Value="key2_cp_x509" />

Thanks,

LG