Why use an x.509 certificate to encrypt xml? Why not just transmit over https?

Question

Don\'t know much about encryption...

Say I\'m preparing a SAML request to submit to an identity provider. Why would I need to apply an x.509 certificate to this request?

Answer 1

Yes - SSL is enough - but SSL is only point-to-point. You cannot secure your connection using SSL if there are a few intermediaries in the way between your source and your target machine.

In that case, e.g. when transmitting over the internet, you must safeguard the actual message, instead of the transport-level. That's why you need to encrypt the XML (or at least parts of it).

Marc