title: Managing rollover with Saml 2 metadata
body: <p>We are trying to implement a smooth rollover for our saml 2 service provider signing certificates.</p>
  <p>We have created new certificates with a notBefore at the date of the rollover in the future. Those certificates are exposed on our metadata endpoint, along the certificates currently used to sign saml messages. They are not yet valid since the notBefore property is in the future. Our service provider will start using them when they become valid.</p>
  <p>However some partners are having issues with their identity providers complaining that the new certificate is not yet valid.</p>
  <p>So my question is the following: are we allowed to expose future certificates that are not yet valid? If not, how are we supposed to manage the signing certificate rollover in saml 2?</p>