View source for Using 'Live' and 'Test' keys

''The [http://raven.cam.ac.uk/project/test-demo/ Test and Demonstration authentication server] documentation contains dire warnings that "It is vital to keep these demo keys separate from keys used with a production service". But is it possible to have, for example, one virtual host using the demo Raven system, as well as a separate virtualHost using the production Raven system?''

Ucam Webauth authentication response messages are signed and include the
identifier of the private key used to sign them. Application agents such as
mod_ucam_webauth will accept a response message as valid providing they have
access to the corresponding public key and the signature is correct. If
mod_ucam_webauth is configured to look for keys in a directory that includes
the demo key then it will automatically accept as valid messages that anyone
can forge, because [https://raven.cam.ac.uk/project/keys/demo_server/ the demo 'private' key is published].

While normally defaulted, the location of the directory which mod_ucam_webauth 
searches to find keys is configurable (see the AAKeyDir directive). Providing
this directive is used so that different virtual hosts are configured to accept
different keys then it's possible to have both production and test
protection safely on the same physical machine. Essentially you should be
safe providing the 'live' and 'test' keys never appear in the same keys
directory.