Renew the SAML signing certificate

SAML signing certificates last 730 days. A badly coordinated renewal makes an application stop accepting responses, so the change happens in two phases.

How do I know it is expiring?

Under «Manage» › «SAML applications», the «Signing certificate» shows its «Valid until» date. 60 days before the end, the console warns: «This certificate expires within 60 days: add the next one and update every application.»

How do I renew?

1. Ask the team that operates the service to add the next certificate. The console and the metadata then also show the «Next signing certificate». Responses are still signed with the current one.
2. Give the new certificate to each application: upload the PEM («Download certificate (PEM)») or, for applications that read the metadata, refresh it.
3. When every application has the new certificate, the operations team switches signing to it.

An application you forgot stops accepting responses from that moment.

An application says "invalid signature"

The application has an old certificate. Compare the SHA-256 fingerprint shown in the console with the one configured in the application and upload the current certificate.

And Microsoft 365?

The Microsoft 365 federation has its own key and renewal. See Federate a Microsoft 365 domain.