> For AI agents: [llms.txt](https://docs.trustedauth.com/llms.txt) provides a Markdown index of this documentation.

# Create SAML signing certificates

SAML signing certificates contain a key pair that you associate with a SAML application. The private key signs the SAML responses that IDaaS returns to a SAML service provider for SAML authentication. You can export the signing certificate and import it into the SAML service provider to validate the signature that the SAML assertion returns.

IDaaS provides a default self-signed certificate. You can use this certificate or create your own. You can also replace a self-signed certificate with a certificate signed by a CA either by importing a signing key or with a certificate signing request (CSR). You need to export the certificate to integrate IDaaS with a SAML application.

note

If you enable notifications (see [Manage entitlement usage notifications](/docs/notifications-and-email/manage-notifications/manage-entitlement-usage-and-expiration-notifications.md)), users receive an email when their certificates are soon to expire or are no longer valid.

## Export a certificate

1. Log in to your IDaaS administrator account.
2. Click Menu icon **>** **Security > Applications**. The **Applications List** page appears.
3. Under **SAML Cloud Integrations**, click **SAML Signing Certificates**. The **SAML Signing Certificates** page appears.
4. Click Arrow Down To Line icon next to the certificate to export the certificate you want to import into your SAML service provider application. The **Export Certificate** dialog box appears.
   1. If the certificate has been issued by a CA, do one of the following:
      - Click **Certificate** to export the self-signed certificate.
      - Click **Root CA Certificate** to export a certificate issued from a CA.
      - Click **Certificate Chain** to export the SAML signing certificate and its CA certificates.
   2. Click **Export**.

## Copy a SAML signing certificate

1. Log in to your IDaaS administrator account.
2. Click Menu icon **>** **Security > Applications**. The **Applications List** page appears.
3. Under **SAML Cloud Integrations**, click **SAML Signing Certificates**. The **SAML Signing Certificates** page appears.
4. Click Copy icon next to the certificate to copy it to the clipboard.
5. Open a text editor, such as Notepad, and paste the contents of the certificate into the text file.
6. Save the file.

## Create or import a SAML signing certificate

IDaaS provides a default self-signed certificate. You can also create your own certificate. This might be necessary if your certificate is about to expire or you want to create a certificate and replace the self-signed certificate with a certificate signed by a Certificate Authority (CA).

1. Log in to your IDaaS administrator account.
2. Click Menu icon **>** **Security > Applications**. The **Applications List** page appears.
3. Under **SAML Cloud Integrations**, click **SAML Signing Certificates**. The **SAML Signing Certificates** page appears.
4. Click Circle Plus icon.
5. Do one of the following:
   1. Create a SAML signing certificate
      1. Select **Create** to create a new signing certificate. The **Create Signing Certificate** dialog box appears.
      2. Enter a **Name** for the certificate.
      3. Select a **Key Type** for the certificate. RSA key types are supported.
      4. Select **Expiry Date (Not After)** from the pop-up calendar, and then click **OK**.
      5. Click **+**. The certificate appears on the **Signing Certificates** page.
   2. Import a SAML signing certificate
      1. Select **Import** to create a new signing certificate. The **Create Signing Certificate** dialog box appears.
      2. Enter a **Name** for the certificate.
      3. Click Arrow Up From Line icon and browse to select your signing certificate file.
      4. Click **Import**.

## Replace a self-signed certificate with a CA signed certificate using a Certificate Signing Request (CSR)

You can create a PKCS#10 request, which is a standard file that a CA uses to issue certificates. It contains a public key that has been signed by the corresponding private key. To do this, you must generate a CSR and then process the CSR response.

### Generate a CSR

1. Log in to your IDaaS administrator account.

2. Click Menu icon **>** **Security > Applications**. The **Applications List** page appears.

3. Under **SAML Cloud Integrations**, click **Signing Certificates**. The **Signing Certificates** page appears.

4. On the **Signing Certificates** page, click Ellipsis Vertical icon next to the certificate.

5. Select **Generate CSR**. The **Generate CSR** dialog box appears.

6. Enter the values for any of the following attributes for the **Distinguished Name (DN)**. The required values depend on the CA you are going to use to issue your CA-signed certificate:

note
Do not enter values with o=.

- **Common Name (CN)**: Enter a name that identifies your certificate. This field is mandatory.
- Optionally, enter the following:
  - **Organization Unit (OU)**: Enter the name of the organization unit handling the certificate.
  - **Organization (O)**: Enter the legal name of your organization.
  - **Locality (L)**: Enter the city location of your organization.
  - **State/Province (ST)**: Enter the full state, province, or territory name of your organization (do not use abbreviations).
  - **Country (C)**: Enter the two-letter ISO code for the country location of your organization.

7. Click **Next**. You are prompted to add **Subject Alt Names**.

8. Optional. If your certificate requires **Subject Alt Names**, do the following to include additional sites protected by the certificate:

   1. Click **Add**.
   2. Move the toggle switch to **DNS Name** or **IP Address**.
   3. Enter the **DNS Name** or **IP Address**.
   4. Repeat these steps to add more Subject Alt Names.

9. Click **Next**. The **Key Type and Signing Algorithm** page appears.

   1. Confirm **Key Type**. You cannot change the existing key type.
   2. Select the **Signing Algorithm** from the drop-down list.
   3. Optional. Enter the **Challenge Password**.
   4. Click **Next**.

10. Review the **Summary**, and then click **Generate CSR** to create the CSR file.

### Process the CSR Response

Once the CA processes the CSR, you need to process the CSR response in IDaaS.

1. Log in to your IDaaS administrator account.
2. Click Menu icon **>** **Security > Applications**. The **Applications List** page appears.
3. Under **SAML Cloud Integrations**, click **Signing Certificates**. The **Signing Certificates** page appears.
4. On the **Signing Certificates** page, click Ellipsis Vertical icon next to the certificate.
5. Select **Process CSR Response** from the drop-down list. The **Process CSR Response** dialog box appears.
6. Click Arrow Up From Line icon and browse to upload the CSR Response file.
7. Click Arrow Up From Line icon and browse to upload **Additional Certificates**.
8. Click **Submit**.