Updating Service Provider IDP SSO Certificate

The information provided is to help you understand how and where to update an existing certificate with a new certificate from your SP SSO provider. Our information assumes you have a working knowledge of SSO setup with your company's provider such as Okta or Azure AD. If you have any questions, please reach out to SSOSupport@kincentric.com .

Certificate

Click this link to download the certificate: 2023 certificate
- The 2023 certificate is valid immediately and must be updated by Monday, July 31, 2023.

General Pointers

The configuration of your Identity Provider will dictate where the certificate needs to be updated as the certificate may need to be updated for both verifying the signature of incoming requests and encrypting assertions sent to the Service Provider.
If your Identity Provider supports pulling metadata from a Service Provider's endpoint, it will be pulled from {YourSubDomainName}/handlers/metadata.ashx. For example, if your subdomain is HappyKitchens.modernsurvey.com, the metadata endpoint would be:
- HappyKitchens.modernsurvey.com/handlers/metadata.ashx
If your Identity Provider is configured to verify signatures from the Service Provider, the new certificate should be configured to be used for signature verification alongside the current/outgoing certificate. This will put your Identity Provider in a state to be prepared when the current certificate/outgoing expires and the new certificate beings to be used by the Service Provider for signing.
- If you remove the current certificate from the Identity Provider's signature verification your existing SSO connection will break.
- The current/outgoing certificate can be removed from your Identity Provider after it has expired.
If your Identity Provider is configured to encrypt assertion/tokens the new certificate can replace the current/outgoing certificate immediately and must be replace prior Tuesday, August 1, 2023 @ 11:50 PM UTC.

Provider Tips

Please refer to your provider's applications/instructions to find where to update your certificate.

Here are two examples of the most popular SSO providers and where you can find their certificates.

Azure AD

Microsoft's Azure AD instructions for updating the SP certificate can be found here:
- https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/howto-saml-token-encryption?tabs=azure-portal
- You can find the certificate under Token encryption.

OKTA

OKTA's instructions for updating the SP certificate can be found here:
- https://help.okta.com/oie/en-us/Content/Topics/Apps/Apps_App_Integration_Wizard_SAML.htm
- You can find the certification under Application/Applications/Edit SAML Integration/Show Advanced Settings