Define the back end certifiate as a resource because there will only …

…be one.

manifests/mod/shib.pp

@@ -5,6 +5,8 @@
 	$styleSheet			= "/shibboleth-sp/main.css",
 	$shib_conf_dir	= '/etc/shibboleth',
 	$shib_conf_file	= 'shibboleth2.xml',
+	$shib_sp_cert		= 'sp-cert.pem',
+	$shib_bin_dir		= '/usr/sbin',
 	$handlerSSL			= 'true'
 ){
 

manifests/mod/shib/backend_cert.pp

@@ -0,0 +1,14 @@
+class apache::mod::shib::backend_cert(
+	$sp_hostname		= $fqdn
+){
+
+	require apache::mod::shib
+
+	$sp_cert = "${apache::mod::shib::shib_conf_dir}/${apache::mod::shib::shib_sp_cert}"
+
+	exec{"shib_keygen_${sp_hostname}":
+		path 		=> [$apache::mod::shib::shib_bin_dir,'/usr/bin','/bin'],
+		command	=> "shib-keygen -h ${sp_hostname} -e https://${sp_hostname}/shibbloeth",
+		unless	=> "openssl x509 -noout -in ${sp_cert} -issuer|grep ${sp_hostname}",
+	}
+}