Signing Certificate Shows the Same Issuer and Issued By Domain

This article addresses why tenant and Security Assertion Markup Language (SAML) signing certificates are self-signed by default. This clarifies observations where the Issued to and Issued by fields are the same and do not show a trusted Certificate Authority (CA).

• Tenant Signing Keys
• Security Assertion Markup Language (SAML) Addon
• Certificates

Tenant and SAML certificates are self-signed by default because they are generally intended for internal use, specifically between two applications or endpoints controlled by the same organization.

The SAML certificate falls under this classification, as both the SAML Identity Provider (IdP) and the Service Provider (SP) are considered to be under the control of the same organization.

The tenant certificate is not used for Domain Name System (DNS) resolution. The primary Auth0 certificate, which is signed by a trusted CA, handles this.

If a CA-signed certificate is required for the SAML connection, the connection can be updated using the Management API. This allows replacing the default certificate with a custom public/private key pair that is CA-signed.

The steps to update the connection are documented in Use Custom Certificate to Sign Requests.