As Gluu generated certificates with only 1 year lifetime at installation we are now trying to rollover the certificates but cant get it to work. For this we have generated new selfsigned cert's with a lifetime of 10 years. Certificates are placed in /etc/certs After restarts nothing changes, Gluu are still releasing only the old certs If we exchange the certfiles under /etc/certs we can get Gluu to use only the new certs but during a rollover its necessairy to have both the new and old keys in the metadata. Files we have altered is idp.properties and credentials.xml. Are we missing something? Cuts from config-files are below: *idp.properties* #### Settings for public/private signing and encryption key(s) #### During decryption key rollover, point the ".2" properties at a second ##### keypair, uncomment in credentials.xml, then publish it in your metadata. idp.signing.key = /etc/certs/idp-signing.key idp.signing.cert = /etc/certs/idp-signing.crt idp.encryption.key = /etc/certs/idp-encryption.key idp.encryption.cert = /etc/certs/idp-encryption.crt idp.signing.key.2 = /etc/certs/idp-signing2.key idp.signing.cert.2 = /etc/certs/idp-signing2.crt idp.encryption.key.2 = /etc/certs/idp-encryption2.key idp.encryption.cert.2 = /etc/certs/idp-encryption2.crt *credentials.xml* <util:list id="shibboleth.SigningCredentials"> <ref bean="shibboleth.DefaultSigningCredential" /> <ref bean="shibboleth.DefaultSigningCredential2" /> </util:list> <bean id="shibboleth.DefaultSigningCredential" class="net.shibboleth.idp.profile.spring.factory.BasicX509CredentialFactoryBean" p:privateKeyResource="%{idp.signing.key}" p:certificateResource="%{idp.signing.cert}" p:entityId-ref="entityID" /> <bean id="shibboleth.DefaultSigningCredential2" class="net.shibboleth.idp.profile.spring.factory.BasicX509CredentialFactoryBean" p:privateKeyResource="%{idp.signing.key.2}" p:certificateResource="%{idp.signing.cert.2}" p:entityId-ref="entityID" /> <alias alias="shibboleth.DefaultClientTLSCredential" name="shibboleth.DefaultSigningCredential" /> <alias alias="shibboleth.EncryptionCredentials" name="shibboleth.DefaultEncryptionCredentials" /> <util:list id="shibboleth.DefaultEncryptionCredentials"> <bean class="net.shibboleth.idp.profile.spring.factory.BasicX509CredentialFactoryBean" p:privateKeyResource="%{idp.encryption.key}" p:certificateResource="%{idp.encryption.cert}" p:entityId-ref="entityID" /> <bean class="net.shibboleth.idp.profile.spring.factory.BasicX509CredentialFactoryBean" p:privateKeyResource="%{idp.encryption.key.2}" p:certificateResource="%{idp.encryption.cert.2}" p:entityId-ref="entityID" /> </util:list> </beans>