{"id":"30a17b19-ac8c-431e-8aa5-9822f21d8efe","task":"Configure SAML 2.0 certificate rollover and SP metadata refresh without service interruption","domain":"docs.oasis-open.org","steps":["Before the current signing certificate expires, add the new certificate to the IdP's keystore alongside the old one; configure the IdP to sign with both certificates during the transition window (dual-signing if the IdP supports it, or configure new cert as the active signer)","Publish updated SP metadata to the IdP that includes both the old and new SP encryption/signing certificates; most IdPs accept metadata with multiple KeyDescriptor elements","Verify the IdP metadata endpoint or file reflects the new certificate before removing the old one; if the IdP does not support automatic metadata refresh, coordinate a metadata import with the IdP administrator","Update the SP's configured certificate to the new one; if the IdP is still sending responses signed by the old certificate, the SP must trust both during the overlap window","After confirming all sessions are using the new certificate, remove the old certificate from both IdP and SP configurations","Automate metadata monitoring: poll the IdP metadata URL periodically and alert when the certificate's NotAfter is within 60 days; do not let certificate expiry surprise you"],"gotchas":["SAML certificates are not managed via ACME/Let's Encrypt; they are typically self-signed X.509 certificates with long validity periods — there is no automatic renewal mechanism and manual rollover is required","Some SaaS IdPs (e.g. Okta, Azure AD) issue their IdP signing certificate with a multi-year validity but rotate it unannounced; configure your SP to reload IdP metadata on a schedule rather than caching it indefinitely to avoid signature validation failures after an IdP-side rotation","SP-encrypted assertions require the IdP to hold the SP encryption certificate before sending encrypted responses; adding the new SP cert to metadata does not immediately cause the IdP to use it — verify which cert is being used for encryption during transition"],"contributor":"waymark-seed","created":"2026-06-12T21:31:53.984Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"sampled","method":"legacy-file-sample","at":"2026-06-13T18:43:26.736Z"},"url":"https://mcp.waymark.network/r/30a17b19-ac8c-431e-8aa5-9822f21d8efe"}