Keep your SSO connection secure by updating SSO certificates
When your organization's identity provider (IdP) renews or replaces the certificate used for Single Sign-On (SSO), update the certificate configured in Enterprise. Keeping the certificate current helps maintain successful authentication between your identity provider and Enterprise.
Jump to what you want
When to update an SSO certificate
Update the certificate when:
- Your identity provider renews an existing certificate.
- Your organization replaces a certificate before it expires.
- You receive a new signing certificate from your identity provider.
- Certificate-related authentication issues require a certificate replacement.
Setting up SSO for the first time? See Single Sign-On (SSO) Self-Service Setup for instructions on creating and configuring an SSO connection.
Before you begin
- Confirm you have administrator access to Enterprise.
- Obtain the new certificate from your identity provider administrator.
- Verify the certificate is in a supported format (.pem or .cer).
- Coordinate the update with the team responsible for your identity provider.
Important: The certificate configured in Enterprise must match the certificate configured in your identity provider. If the certificates do not match, SSO authentication may fail.
Information in this article reflects a standard Enterprise configuration. Your Enterprise platform is based on your organization’s configuration. Settings and/or data visibility rules may vary slightly from what is described.
Update the certificate
-
Navigate to VMS Settings > Integration Services > Single Sign-On (SSO).
- Select the SSO connection you want to update.
- Select Edit.
-
Upload the new certificate.
What this does: Replaces the existing certificate associated with the SSO connection.
Why it matters: Enterprise must use the same certificate that is currently configured in your identity provider.
In simple terms: You're replacing the old certificate with the new one.
-
Verify that the correct certificate was uploaded.
What this does: Confirms the certificate details before the update is applied.
Why it matters: Uploading the wrong certificate can prevent users from signing in through SSO.
- Select Save.
What this does: Applies the new certificate to the SSO connection.
Why it matters: The new certificate is not used until the changes are saved.
In simple terms: You're activating the new certificate.
- Select OK to confirm the update.
Allow a few moments for your changes to take effect.
Verify the update
After updating the certificate:
- Confirm the new certificate appears in the SSO configuration.
- Test SSO authentication.
What this does: Verifies that Enterprise can successfully authenticate users through your identity provider.
Why it matters: Testing immediately after the update helps identify configuration issues before they affect users.
In simple terms: You're confirming that SSO still works.
- Verify users can successfully sign in using SSO.
- Check for any certificate-related authentication errors.
Troubleshooting
Users can't sign in after the update
Verify that the same certificate is configured in both Enterprise and your identity provider. Authentication may fail if the certificates do not match.
The certificate upload fails
Confirm that the certificate file is valid and uses a supported format (.pem or .cer).
SSO authentication fails after a certificate renewal
Verify that the renewed certificate was uploaded to the correct SSO connection and that the changes were saved successfully.
The wrong certificate was uploaded
Upload the correct certificate and save the changes. Then test SSO authentication again to confirm the issue is resolved.
- Coordinate certificate changes with your identity provider administrator.
- Test SSO immediately after updating a certificate.
- Maintain records of certificate expiration dates and renewal schedules.
- Periodically review SSO configurations to ensure certificate information remains current.
| Persona | Modules | Documentation release | Feedback? Email us: |
|---|---|---|---|
| Clients, program office users, system administrators | Data & Integrations Self-service | Beeline Enterprise | Q4 2026 | beelinecommunity@beeline.com |