Updating or replacing an existing custom domain certificate that Okta does not manage requires adding the new certificate, private key, and certificate chain in the Okta Admin Console. The certificate must meet the Rivest-Shamir-Adleman (RSA) key size and Secure Hash Algorithm (SHA) requirements to avoid errors.

• Custom Domain
• Certificate
• Okta Classic Engine
• Okta Identity Engine (OIE)

What are the steps to update a non-Okta managed custom domain certificate?

Update the custom domain certificate by navigating to the Brands section in the Okta Admin Console and providing the new certificate details.

1. Log in to the Okta Admin Console.
2. Navigate to Customizations > Brands > select the Brand > go to the Domains tab.
3. Click the Edit button, and click the Update Certificate button.
   

   The following image displays the Update Certificate button in the Domains tab.

4. Paste the new certificate, private key, and certificate chain into the respective fields, and include the "Begin" and "End" tags.
   

   The following image provides an example of the correctly formatted certificate fields.

5. Click the Finish button.

The custom domain certificate must meet specific requirements.

Review the following certificate requirements to ensure compatibility.

• The RSA key sizes must equal 2048 bits, 3072 bits, or 4096 bits.
• The certificate requires a SHA signature, such as SHA256, SHA384, or SHA512.

For more information, review the Caveats section from the documentation.

Validate the certificate information using OpenSSL to avoid errors.

Use OpenSSL to review and validate the certificate information before uploading it to Okta.

openssl x509 -in certificate.crt -noout -text

Validating the certificate helps avoid errors, such as the following example.

Private key length exceeded

Related References

• Customize the domain and email address
• Update a Non-Okta Managed Custom Domain Certificate via API