This article explains how to update or replace an existing custom domain certificate that is not Okta-managed.

• Custom Domain
• Certificate
• Okta Classic Engine
• Okta Identity Engine (OIE)

1. Log in to the Okta Admin Console.
2. Navigate to Customizations > Brands > select the Brand > go to the Domains tab.
3. Click the Edit button, and click the Update Certificate button.

4. Paste in the new certificate, private key, and certificate chain,  following the format required, adding the "Begin/End" in each field, for example:

5. Click the Finish button.

Make sure to review the certificate requirements:

• The RSA key sizes must be 2048 bits, 3072 bits, or 4096 bits.
• It should be signed with a SHA256, SHA384, or SHA512 hash algorithm.

For more information, review the Caveats section from the documentation.

Use OpenSSL to review and validate the certificate information

openssl x509 -in certificate.crt -noout -text

For example, to avoid errors such as Private key length exceeded:

Related References

• Customize the domain and email address
• Update a Non-Okta Managed Custom Domain Certificate via API