"Signing Certificate Will Expire" Warning for a SAML Connection

This article clarifies the "Signing Certificate Will Expire" warning for a Security Assertion Markup Language (SAML) connection where Auth0 is configured as the Service Provider (SP). This warning can cause confusion when the custom certificate used by the SP to sign requests appears to be valid. The warning email may contain the following subject or message:

Action Required for '<my-saml-link>' connection: Signing certificate will expire in 29 days

• Auth0
• Security Assertion Markup Language (SAML) Connections
• Service Provider (SP) Configuration

The warning message may not specify which certificate is expiring, which can cause confusion.

• SP Signing Certificate: When Auth0 is configured as a SAML Service Provider (SP), a custom key can be used to sign requests sent from the SP to the Identity Provider (IdP). This is detailed in Use a Custom Key to Sign Requests. The validity of this key can be checked with the following openssl command, where <certificate.crt> is the certificate file.

openssl x509 -in <certificate.crt> -text -noout

• IdP Signing Certificate: If the SP certificate is valid, the warning message most likely refers to the certificate used by the IdP to sign SAML responses that are sent to Auth0. The email is warning that the IdP's certificate will expire soon. This is configured as described in Receive Signed SAML Authentication Responses.

The steps to resolve this issue depend on who manages the Identity Provider (IdP).

• If the IdP is managed internally: The administrator must renew the certificate in the IdP's system before it expires. It is a best practice to use a spreadsheet or automated reminder system to track the expiration dates of all SAML certificates.

• If the IdP is managed by a downstream customer: The customer (the IdP owner) must be contacted and reminded to update the certificate. The IdP owner is responsible for renewing the certificate in a timely manner.