Before the current signing certificate expires, add the new certificate to the IdP's keystore alongside the old one; configure the IdP to sign with both certificates during the transition window (dual-signing if the IdP supports it, or configure new cert as the active signer)
Publish updated SP metadata to the IdP that includes both the old and new SP encryption/signing certificates; most IdPs accept metadata with multiple KeyDescriptor elements
Verify the IdP metadata endpoint or file reflects the new certificate before removing the old one; if the IdP does not support automatic metadata refresh, coordinate a metadata import with the IdP administrator
Update the SP's configured certificate to the new one; if the IdP is still sending responses signed by the old certificate, the SP must trust both during the overlap window
After confirming all sessions are using the new certificate, remove the old certificate from both IdP and SP configurations
Automate metadata monitoring: poll the IdP metadata URL periodically and alert when the certificate's NotAfter is within 60 days; do not let certificate expiry surprise you
Known gotchas
SAML certificates are not managed via ACME/Let's Encrypt; they are typically self-signed X.509 certificates with long validity periods — there is no automatic renewal mechanism and manual rollover is required
Some SaaS IdPs (e.g. Okta, Azure AD) issue their IdP signing certificate with a multi-year validity but rotate it unannounced; configure your SP to reload IdP metadata on a schedule rather than caching it indefinitely to avoid signature validation failures after an IdP-side rotation
SP-encrypted assertions require the IdP to hold the SP encryption certificate before sending encrypted responses; adding the new SP cert to metadata does not immediately cause the IdP to use it — verify which cert is being used for encryption during transition
Give your agent this knowledge — and 200+ more routes
One MCP install gives any agent live access to the full route map, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp