Salesforce SAML SSO certificate renewal without an outage

The two certificates

• Identity Provider Certificate: uploaded from your identity provider (Okta, Entra ID, Ping and so on) and used to verify the assertions it sends. Its lifetime is set by the identity provider, typically one to three years.
• Request Signing Certificate: chosen from Certificate and Key Management and used to sign requests Salesforce sends. It follows Salesforce's certificate rules (one year self-signed, two at 4096-bit), and the certificate expiry guide covers it.

What users and admins see

Salesforce's own summary: “When a certificate expires, users will be unable to authenticate via SSO.” In Login History the failed logins show the status Signature Invalid, meaning the certificate you uploaded failed to validate the signature in the assertion. A corrupt certificate shows Configuration Error/Perm Disabled. For the OAuth SAML assertion flow, integrations get:

{"error":"invalid_grant","error_description":"invalid assertion"}

Find the certificates and their dates

1. Setup, Single Sign-On Settings, open the SAML setting. Both certificates are shown.
2. The Request Signing Certificate has an expiry date in Certificate and Key Management.
3. The Identity Provider Certificate has no expiry date field. It is stored as SamlSsoConfig.ValidationCert, so read the date from the certificate itself, for example with openssl x509 -enddate, or from your identity provider's console.

Rotate the identity provider certificate

1. Before you start, make sure an admin can log in with a username and password, using https://MyDomainName.my.salesforce.com/?login, in case SSO breaks mid-change.
2. Agree a time with whoever runs the identity provider. Salesforce documents a coordinated cutover: both sides change together, because mismatched certificates cause authentication failures.
3. Setup, Single Sign-On Settings, Edit the setting, Identity Provider Certificate, Choose File (.crt or .cer), Save.
4. Test a login straight away, and check Login History for Signature Invalid.

Rotate the request signing certificate

1. Create a new self-signed certificate in Certificate and Key Management.
2. Select it as the Request Signing Certificate in the SSO setting.
3. Give the new .crt to the identity provider team, then delete the old certificate once nothing uses it.

Check a failing login

Setup, Single Sign-On Settings, SAML Assertion Validator. Paste the assertion (XML, base64 or deflated base64) and validate. After a failed login it is pre-filled where possible. It checks only the assertion, so use Login History for everything else, and run it again after each fix because one run can stop at the first problem.

Limits worth knowing

• Salesforce accepts an assertion up to 8 minutes after its timestamp and 3 minutes before it.
• SAML is disabled in sandbox copies until you set it up again.

Common mistakes

1. Uploading the new certificate before the identity provider starts signing with it, or the other way round.
2. Having no admin who can bypass SSO when it fails.
3. Relying on Salesforce's certificate emails, which do not cover the uploaded identity provider certificate.