Rotate a Signing Certificate for Custom SAML Applications in Okta

Okta does not automatically replace and activate new certificates for custom Security Assertion Markup Language (SAML) applications before the old certificate expires. Okta requires a manual rollover process to prevent downtime because automatic rotation breaks the trust with the Service Provider (SP). Okta generates a notification in the Tasks section of the Okta Admin Console and via email 60 days before the expiration, prompting a manual renewal of the signing certificate.

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Custom Security Assertion Markup Language (SAML) Applications

What are the steps to rotate a signing certificate for a custom SAML application?

Generate a new certificate in the Okta Admin Console, upload it to the custom application, and activate it in Okta.

1. In the Okta Admin Console, go to Applications > Applications.
2. Select the custom SAML application.
3. Select the Sign On tab.
4. Scroll to the SAML Signing Certificates section.
5. Click Generate New Certificate.
   • NOTE: Okta generates a new certificate with an Inactive status, while the old certificate remains Active.
6. Download the new certificate or metadata.
7. Upload the new certificate to the SAML settings of the custom application.
   • NOTE: If the application does not support multiple certificates, perform this step during a scheduled maintenance window.
8. Return to the SAML Signing Certificates section in Okta.
9. Locate the new certificate.
10. Click Actions and select Activate.