Rotating Google Identity Provider Certificates

This article clarifies the process for rotating a Google Identity Provider (IdP) certificate when it is nearing expiration. It addresses scenarios involving Google Social Connections using OAuth 2.0 and Google Workspace using Security Assertion Markup Language (SAML).

• Google Social Connection
• Google Workspace SAML Enterprise Connection
• OAuth 2.0
• SAML

The certificate rotation process depends on the connection type configured in the tenant.

Google Social Connections (OAuth 2.0)

Google Social Connections use the OAuth 2.0 protocol and do not require manual certificate rotation. These connections rely on a permanent Client ID and Client Secret. All credential management and rotation for these connections are handled automatically on the backend. No action is required from the user.

Google Workspace (SAML Enterprise Connections)

If using Google Workspace as a SAML enterprise IdP, the signing certificate must be rotated manually within the Google Admin console first. Refer to the official Google documentation for instructions on Maintaining SAML Certificates.

After the new certificate is generated and assigned in Google, update the connection settings in the Auth0 Dashboard. You will have to upload the new certificate file or enter the certificate details in the X509 Signing Certificate field for your preferred SAML connection.

NOTE: The connection settings must be updated with the new certificate to prevent Single Sign-On (SSO) failure.