This article explains the steps to revert a SHA256 certificate to SHA1 for Security Assertion Markup Language (SAML) and API in Okta. This process involves using the Okta API in Postman, modifying certificate files, and updating the application's key credentials. This solution is useful if it is needed to support legacy systems that do not support SHA256 certificates.

• Revert a SHA256 certificate to SHA1
• Security Assertion Markup Language (SAML)
• API

Check out this video for more information.

NOTE: Before following these steps for Okta Integration Network (OIN) applications, please make sure to include the necessary application details. For example, in the case of Office 365, be sure to specify the federated domains, federation method, and SSO method. Incomplete information could reset the app to the default OIN values.

1. Follow the steps to integrate Postman with Okta.

2. Get the application's details by calling GET {{url}}/api/v1/apps/{{appID}}. Copy the id, name, label, and signOnMode provided in the response - these will be used later.

3. List the application's certificates by calling GET {{url}}/api/v1/apps/{{appID}}/credentials/keys. Note that there are at least 2 certificates provided in the response.

4. Copy the value of the first x5c element and save this in a text editor of choice. In the text file, modify it so it follows PEM formatting by prepending -----BEGIN CERTIFICATE----- and appending -----END CERTIFICATE-----.

5. Save the file as a .crt file.

6. Repeat Steps 4-5 for any other certificates provided in the Get Credential Keys response.

7. Use the computer's keychain tool or OpenSSL to validate which of the certificates is using SHA1.

8. In Postman, copy the kid value for the SHA1 cert from the response provided in step 3.

9. Update the key credential for the app by calling PUT {{url}}/api/v1/apps/{{appid}}.

   • In the Body of the request, enter the following JSON code, substituting the values noted in step 2:

{

"name": "{{appName}}",

"label": "{{appInstanceLabel}}",

"signOnMode": "{{appSignOnMode}}",

"credentials": {

"signing": {

"kid": "{{keyId}}"

}

}

}

10. In the Okta Admin Console, navigate to the App's Single Sign-On tab, click View Setup Instructions, and re-upload the metadata, including the new SHA1 certificate, to the service provider.