> For AI agents: [llms.txt](https://docs.trustedauth.com/llms.txt) provides a Markdown index of this documentation.

# Create and manage OIDC signing certificates

OIDC signing certificates contain a key pair that you associate with an OIDC application. The private key signs the OIDC tokens that IDaaS returns to an OIDC service provider for OIDC authentication. The signing certificate and associated public key are available through the OIDC JWKS endpoint. The OIDC service provider uses this endpoint to validate OIDC token signatures.

IDaaS provides a default self-signed certificate. You can use this certificate or create your own. You can also replace a self-signed certificate with a certificate signed by a CA either by importing a signing key or with a certificate signing request (CSR).

You can export the signing certificate for use with your OIDC service provider application.

note

If you enable notifications (see [Manage entitlement usage notifications](/docs/notifications-and-email/manage-notifications/manage-entitlement-usage-and-expiration-notifications.md)), users receive an email when their certificates are soon to expire or are no longer valid.

## Export a signing certificate

1. Log in to your IDaaS administrator account.
2. Click Menu icon **>** **Security > Applications**. The **Applications List** page appears.
3. Under **OpenID Connect and OAuth Cloud Integrations**, click **OIDC Signing Certificates**. The **OIDC** **Signing Certificates** page appears.
4. Click Arrow Down To Line icon next to the certificate to export the certificate you want to import into your OIDC service provider application. The **Export Certificate** dialog box appears.
   1. If the certificate has been issued by a CA, do one of the following:
      - Click **Certificate** to export the self-signed certificate.
      - Click **Root CA Certificate** to export a certificate issued from a CA.
      - Click **Certificate Chain** to export the OIDC signing certificate and its CA certificates.
   2. Click **Export**.

## Copy an OIDC signing certificate

1. Log in to your IDaaS administrator account.
2. Click Menu icon **>** **Security > Applications**. The **Applications List** page appears.
3. Under **OpenID Connect and OAuth Cloud Integrations**, click **OIDC Signing Certificates**. The **OIDC Signing Certificates** page appears.
4. Click Copy icon next to the certificate to copy it to the clipboard.
5. Open a text editor, such as Notepad, and paste the contents of the certificate into the text file.
6. Save the file.

## Create or import an OIDC signing certificate

IDaaS provides a default self-signed certificate. You can also create your own certificate. This might be necessary if your certificate is about to expire or you want to create a certificate and replace the self-signed certificate with a certificate signed by a Certificate Authority (CA).

1. Log in to your IDaaS administrator account.
2. Click Menu icon **>** **Security > Applications**. The **Applications List** page appears.
3. Under **Open ID Connect and OAuth Cloud Integrations**, click **OIDC Signing Certificates**. The **OIDC** **Signing Certificates** page appears.
4. Click Circle Plus icon.
5. Do one of the following:
   1. Create an OIDC signing certificate.
      1. Select **Create** to create a new signing certificate. The **Create Signing Certificate** dialog box appears.
      2. Enter a **Name** for the certificate.
      3. Select a **Key Type** for the certificate. RSA and EC key types are supported.
      4. Select **Expiry Date (Not After)** from the pop-up calendar, and then click **OK**.
      5. Click **+**. The certificate appears on the **Signing Certificates** page.
   2. Import an OIDC signing certificate.
      1. Select **Import** to create a new signing certificate. The **Create Signing Certificate** dialog box appears.
      2. Enter a **Name** for the certificate.
      3. Click Arrow Up From Line icon and browse to select your signing certificate file.
      4. Click **Import**.

## Replace a self-signed certificate with a CA signed certificate using a Certificate Signing Request (CSR)

You can create a PKCS#10 request, which is a standard file that a CA uses to issue certificates. It contains a public key that has been signed by the corresponding private key. To do this, you must generate a CSR and then process the CSR response.

### Generate a CSR

1. Log in to your IDaaS administrator account.

2. Click Menu icon **>** **Security > Applications**. The **Applications List** page appears.

3. Under **Open ID Connect and OAuth Cloud Integrations**, click **OIDC Signing Certificates**. The **OIDC** **Signing Certificates** page appears.

4. On the **Signing Certificates** page, click Ellipsis Vertical icon next to the certificate.

5. Select **Generate CSR**. The **Generate CSR** dialog box appears.

6. Enter the values for any of the following attributes for the **Distinguished Name (DN)**. The required values depend on the CA you are going to use to issue your CA-signed certificate:

note
Do not enter values with o=.

- **Common Name (CN).** Enter a name that identifies your certificate. This field is mandatory.
- Optionally, enter the following:
  - **Organization Unit (OU).** Enter the name of the organization unit handling the certificate.
  - **Organization (O).** Enter the legal name of your organization.
  - **Locality (L).** Enter the city location of your organization.
  - **State/Province (ST).** Enter the full state, province, or territory name of your organization (do not use abbreviations).
  - **Country (C).** Enter the two-letter ISO code for the country location of your organization.

7. Click **Next**. You are prompted to add **Subject Alt Names**.

8. Optional. If your certificate requires **Subject Alt Names**, do the following to include additional sites protected by the certificate:

   1. Click **Add**.
   2. Move the toggle switch to **DNS Name** or **IP Address**.
   3. Enter the **DNS Name** or **IP Address**.
   4. Repeat these steps to add more Subject Alt Names.

9. Click **Next**. The **Key Type and Signing Algorithm** page appears.

   1. Confirm **Key Type**. You cannot change the existing key type.
   2. Select the **Signing Algorithm** from the drop-down list.
   3. Optional. Enter the **Challenge Password**.
   4. Click **Next**.

10. Review the **Summary**, and then click **Generate CSR** to create the CSR file.

### Process the CSR Response

Once the CA processes the CSR, you need to process the CSR response in IDaaS.

1. Log in to your IDaaS administrator account.
2. Click Menu icon **>** **Security > Applications**. The **Applications List** page appears.
3. Under **Open ID Connect and OAuth Cloud Integrations**, click **Signing Certificates**. The **Signing Certificates** page appears.
4. On the **Signing Certificates** page, click Ellipsis Vertical icon next to the certificate.
5. Select **Process CSR Response** from the drop-down list. The **Process CSR Response** dialog box appears.
6. Click Arrow Up From Line icon and browse to upload the CSR Response file.
7. Click Arrow Up From Line icon and browse to upload **Additional Certificates**.
8. Click **Submit**.