Skip to main content
With SAML SSO, certificates are exchanged between the service provider (anny) and the identity provider (e.g. Microsoft). These certificates are essential for secure authentication with SSO. The certificates are used to sign the exchange of data between the service provider and identity provider. Both parties can verify the signature to make sure the request has not been compromised.

​
Key rollover explained

These certificates are exchanged during setup via the metadata. Every certificate has a specific expiration date. Once it is reached, the certificate is no longer valid. All requests signed with an expired certificate are rejected. So that login remains possible, a key rollover is performed regularly. This happens in two steps. Step 1: A new certificate is created and published At this point, both certificates are valid, and the identity provider or service provider can save the new certificate. Requests are still signed with the existing certificate. This causes no interruption. Step 2: The old certificate is no longer used After a grace period, the old certificate is no longer used and no longer published in the metadata. All requests are now signed with the new certificate. In the meantime, the service provider or identity provider has already stored this certificate. This ensures that login is possible continuously, without interruptions.

​
Identity provider key rollover

If your identity provider performs the key rollover and you have stored the metadata URL in anny, you have nothing further to do. We check twice a day whether your identity provider has published new certificates and update them on our side.

​
Federation key rollover

If your identity provider is part of a federation such as DFN AAI, you also don’t need to do anything else. We handle the key rollover automatically. As soon as your identity provider has published the certificate in the federation, we update it on our side.

​
Service provider (anny) key rollover

As the service provider, we perform the key rollover fully automatically. 14 days before the certificate expires, we create and publish the new certificate. You then receive a notification from us. As a rule, your identity provider handles these certificates fully automatically. If it doesn’t, you need to store the new certificate in your identity provider.

​
Start and finish the rollover yourself

You don’t have to wait for the automatic rollover. As soon as a SAML identity provider is connected, you find the Certificate rollover section in your account settings under SSO & Security. It shows:
  • the current certificate and how long it is valid,
  • the metadata URL,
  • during a rollover, the new certificate, since when the rollover is running, and the latest date we finish it automatically,
  • otherwise, when the next automatic rollover starts.
1

Start the rollover

Click Start rollover. We create a new certificate and publish both certificates in our metadata right away. Login keeps working with the current certificate.
2

Import the new metadata into your identity provider

Import our metadata into your identity provider again using the Metadata URL. If your identity provider reads the metadata URL regularly, this happens automatically.
3

Finish the rollover

As soon as your identity provider trusts the new certificate, click Finish rollover and confirm. From then on, we sign all requests with the new certificate. If you don’t finish the rollover yourself, we do it automatically after 14 days, at the latest shortly before the current certificate expires.
Only finish the rollover once your identity provider knows the new certificate. Otherwise SSO login fails immediately. Finishing can’t be undone.
For identity providers from a federation such as DFN AAI, we keep handling the certificate rollover completely.