When configuring Secure Assertion Markup Language (SAML) authentication in Okta, each application uses an individual certificate by default for enhanced security. Okta provides the option to use a single organization-wide SAML signing certificate across multiple applications to address unique security concerns or meet compliance requirements. Administrators can assign unique SAML certificates to specific applications to mitigate the security risk of a compromised organization-wide certificate.

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Secure Assertion Markup Language (SAML)

What are the differences between organization-wide and individual certificates?

Using an organization-wide certificate simplifies certificate management but exposes a security risk if a compromise occurs, as it affects all applications relying on the same certificate. To mitigate this risk, administrators can leave the default individual certificates assigned to specific applications, providing an additional layer of security and reducing the attack surface.

How do administrators assign a unique SAML certificate to an application?

Generate a new certificate in the application settings, update the service provider with the new metadata, and monitor the expiration date to avoid service disruptions.

1. Navigate to the application requiring an individual certificate.
2. At the bottom of the Sign On tab, in the SAML Signing Certificates section, select Generate new certificate.
3. Update the Service Provider (SP) for that application with the new certificate metadata.
4. Check the expiration date of each certificate regularly and replace it before the expiration date to avoid service disruptions.

NOTE: Okta generates a reminder about expiring certificates as an item in the Tasks section of the Okta Admin Console approximately 60 days before the expiration date of a certificate.

Related References

• Security Risk for Org-Wide Certificate