SimpleSAMLphp Metadata Signing Requires Managed Certificate Lifecycles

SimpleSAMLphp can sign the metadata it publishes and verify signed metadata from other entities, which makes certificates central to federation trust. A valid signature only shows that a known key signed the document, so operators must still decide which keys to trust and how metadata is refreshed and certificates rotated. The article advises using separate keys per entity and environment, keeping private keys restricted, and replacing any sample credentials before production. For rollovers, it recommends publishing the new verification certificate alongside the old one, waiting for consumers to refresh, and then removing the old certificate, while checking how cached metadata behaves when refreshes fail. Testing should cover malformed signatures, expired certificates, and unknown issuers, with monitoring for expiry, refresh failures, and validation errors.