Skip to main content

SAML2 certificate renewal without service interruption

Written by Marie Xhauflair

When adding a new SAML2 signing certificate in Azure AD (Entra ID) or another identity provider, follow these steps:

  1. Add the new certificate in Azure AD alongside the existing certificate. Do not make the new certificate active yet.

  2. Wait at least until the next 06:00 UTC. At that time, we automatically refresh your SAML metadata and will trust both certificates. You do not have to wait if you save your SAML configuration in Control, because saving refreshes the metadata immediately.

  3. Activate the new certificate as the primary signing certificate in Azure AD.

  4. Remove the old certificate only after you've confirmed that login works correctly with the new certificate.

🚧 Be careful: The automatic refresh applies to a SAML configuration with a metadata URL. If your configuration holds pasted metadata XML, nothing refreshes by itself, so replace the XML in Control > Users > Integrations > SAML2 after adding the certificate.

Important: If you activate the new certificate before the metadata is refreshed, SAML login attempts will fail until the refresh has happened.

Did this answer your question?