How to Copy a Certificate From a Working Okta G Suite App to a Non-Working G Suite App

• G Suite, or any applications requiring certificate updates

In certain circumstances, an application integration from a previous working setup will require a certificate to be installed on the target application, in this case, G Suite.  As there can be multiple instances of the Okta G Suite application tied into one G Suite tenant, a previously working setup may be desired to use the same certificate for a newer application when the SAML instructions offer a new certificate, either due to encryption strength or type.

To update a new Okta G Suite instance with a certificate that is being used for an older Okta G Suite instance, perform the following steps:

Notes: These steps assume a familiarity with Postman. Refer to the Get Started with the Okta REST APIs guide for details. 

1. Obtain the AppId for the working configuration.  This can be found by navigating to the app in Okta, and then in the URL bar, see a format like the following:
   https://[my-org]-admin.okta.com/admin/app/google/instance/[appId]/#tab-assignments

2. In Postman, obtain the keyId or 'kid' by performing a "List Certificates" call (part of the Apps Collection under Certificate Operations): {{url}}/api/v1/apps/{{appId}}/credentials/keys - where {{appId}} is the AppId in the URL above

3. In the Body of the response, copy the 'kid' string

4. Under Certificate Operations, navigate to Update Application Certificate.

5. Underneath the PUT request, see a tab for "Body".  In that tab, paste the "kid" value copied in step 3, replacing the {{keyId}}

6. Provide a value for the 'label' portion. This will serve as the "Application Label" of the Target G Suite app.

7. In the Okta Admin Dashboard, navigate to the Target Application, and repeat Step 1 to obtain that app's appId.

8. Back in Postman, in the PUT request URL, paste the Target Application's appId and click "Send"

If all goes as expected, perform another GET for "List Certificates" for the Target App, and the "kid" value and the x509 certificate value should have been updated.