Auth0 Support Center - Supported Formats for SAML Connection Signing Certificate are not Consistent Between Dashboard and Management API

Supported Formats for SAML Connection Signing Certificate are not Consistent Between Dashboard and Management API

Sep 10, 2025

Overview

It is possible to create a SAML connection through the Management API and provide a signing certificate (`options.signingCert`) in one of two formats:

1. a PEM certificate with new lines encoded.
2. a PEM certificate where the full content is encoded in base64.

However, using the first format may lead to issues if a SAML assertion is received without the public key embedded in it, as the server will expect the signing certificate to always be in the second format.

Applies To

SAML Connection
Signing Certificate

Cause

It is possible to set the `signingCert` value to a non-encoded certificate and it will work so long as the IdP sends the public key in the response. If the key is not present, then signature validation will fail.

When a non-encoded certificate is uploaded via the dashboard, it will be automatically encoded, but this is not the case when setting the `signingCert` directly via the management API.

Solution

Ensure that the configured SAML connection is using a base 64 encoded signing certificate in order to avoid the potential issue of an IdP not sending a public key in the SAML Response.