When a SAML app vendor replaces their Single Sign-On (SSO) certificate, Okta requires a configuration update only in specific scenarios. In most cases, no action is necessary. Scenarios that require uploading the new certificate in Okta include Okta Integration Network (OIN) apps with explicit certificate upload requirements and custom SAML apps configured for encrypted assertions, signed requests, or Single Logout (SLO).
- Okta Identity Engine (OIE)
- Okta Classic Engine
- Single Sign-On (SSO) Certificate
- Service Provider (SP)
- Expiring/Retired Certificate
- Certificate Rotation
- Single Logout (SLO)
In most cases, when a Service Provider sends notification of a certificate replacement, Okta does not require configuration changes. A certificate upload in Okta is necessary only when specific app configurations are in use.
When Does a Service Provider Certificate Replacement Require Changes in Okta?
The following scenarios require uploading the new SP certificate in Okta:
- OIN apps that explicitly detail SP certificate upload requirements in their Setup Instructions
- Custom SAML apps configured for encrypted assertions, signed requests, or Single Logout (SLO).
Uploading a certificate to a custom SAML application
The following steps describe how to update a certificate for a custom SAML application.
- Navigate to Applications > Applications and select the application.
- Go to the General tab.
- Choose Edit in the SAML Settings section.
- Select Next to proceed to the Configure SAML page.
- In the SAML Settings section, click Show Advanced Settings.
- Locate the Signature Certificate field under SAML Request and upload the new file provided by the Service Provider.
- Select Next and then Finish.
NOTE: If the impact of a certificate replacement is unclear, contact Okta Support for further assistance.
The following image shows an example of an OIN application (Salesforce) that supports the SLO feature.
The following image shows an example of a custom SAML application's advanced settings that allow the upload of a Service Provider certificate.
