Refresh SAML certificate

A SAML connection can involve two different certificates, and they are refreshed in different places:

• Your identity provider’s signing certificate. The IdP uses it to sign the SAML responses it sends to Kinde. Kinde reads it from the IdP metadata. When your IdP rotates this certificate, follow Keep IdP signing certificates current. For Google Workspace, see Rotate the Google signing certificate.
• Kinde’s request-signing certificate and private key. This optional pair, entered in the Sign SAML request section of the connection, lets Kinde sign the requests it sends to your IdP. If you set it up, you need to refresh it before it expires. The rest of this page covers that.

Refresh the request-signing certificate and private key

Link to this section

Your IdP might issue new certificates, or you can generate a certificate and private key yourself. See Signed certificate and private key.

If you are generating the certificate and private key yourself, you need to add the new certificate to your identity provider first.

1. In Kinde, open the connection:

   • For an environment-level connection, go to Settings > Environment > Authentication, scroll to Enterprise connections, and select Configure on the connection.

     

   • For an organization-level connection, go to Organizations, open the organization, select Authentication; select the three dots next to your connection and select Configure.

     

2. Scroll to the Sign SAML request section and replace the following with new values:

   • Signing certificate: The new certificate.
   • Private key: The new private key.

   

3. Select Save.

   The certificate in your Identity Provider and the one in Kinde must match exactly.