Updating Service Provider IDP SSO Certificate

The information provided is to help you understand how and where to update an existing certificate with a new certificate from your SP SSO provider. Our information assumes you have a working knowledge of SSO setup with your company's provider such as Okta or Entra ID. If you have any questions, please reach out to SSOSupport@kincentric.com.

2025 Certificate Update

The existing certificate will expire on Wednesday, 11 June 2025 @ 11:59 PM UTC. The new 2025 certificate will be available for download starting on Friday, 30 May 2025 @ 10 PM UTC. All applications integrated with Kincentric’s Single Sign-On Platform will need to update to the new certificate prior to Wednesday, 11 June 2025 @ 11:59 PM UTC, to prevent the application from failing to authenticate.

General Pointers

The configuration of your Identity Provider will dictate where the certificate needs to be updated as the certificate may need to be updated for both verifying the signature of incoming requests and encrypting assertions sent to the Service Provider.
If your Identity Provider supports pulling metadata from a Service Provider's endpoint, it will be pulled from {YourSubDomainName}/handlers/metadata.ashx. For example, if your subdomain is HappyKitchens.modernsurvey.com, the metadata endpoint would be:
- HappyKitchens.modernsurvey.com/handlers/metadata.ashx
If your Identity Provider is configured to verify signatures from the Service Provider, the new certificate should be configured to be used for signature verification alongside the current/outgoing certificate. This will put your Identity Provider in a state to be prepared when the current certificate/outgoing expires and the new certificate beings to be used by the Service Provider for signing.
- If you remove the current certificate from the Identity Provider's signature verification your existing SSO connection will break.
- The current/outgoing certificate can be removed from your Identity Provider after it has expired.

Provider Tips

Please refer to your provider's applications/instructions to find where to update your certificate.

Here are two examples of the most popular SSO providers and where you can find their certificates.

Microsoft Entra ID

Microsoft Entra ID instructions for updating the SP certificate can be found here:
- https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/howto-saml-token-encryption?tabs=azure-portal
- You can find the certificate under Token encryption.

OKTA

OKTA's instructions for updating the SP certificate can be found here:
- https://help.okta.com/oie/en-us/Content/Topics/Apps/Apps_App_Integration_Wizard_SAML.htm
- You can find the certification under Application/Applications/Edit SAML Integration/Show Advanced Settings