> ## Documentation Index
> Fetch the complete documentation index at: https://docs.anny.co/llms.txt
> Use this file to discover all available pages before exploring further.

# SSO Key Rollover

> Understand how SAML SSO certificates are renewed so logins keep working without interruption.

With SAML SSO, certificates are exchanged between the service provider (anny) and the identity provider (e.g. Microsoft). These certificates are essential for secure authentication with SSO. The certificates are used to sign the exchange of data between the service provider and identity provider. Both parties can verify the signature to make sure the request has not been compromised.

## Key rollover explained

These certificates are exchanged during setup via the metadata. Every certificate has a specific expiration date. Once it is reached, the certificate is no longer valid. All requests signed with an expired certificate are rejected.

So that login remains possible, a key rollover is performed regularly. This happens in two steps.

**Step 1: A new certificate is created and published**

At this point, both certificates are valid, and the identity provider or service provider can save the new certificate. Requests are still signed with the existing certificate. This causes no interruption.

**Step 2: The old certificate is no longer used**

After a grace period, the old certificate is no longer used and no longer published in the metadata. All requests are now signed with the new certificate. In the meantime, the service provider or identity provider has already stored this certificate.

This ensures that login is possible continuously, without interruptions.

## Identity provider key rollover

If your identity provider performs the key rollover and you have stored the metadata URL in anny, you have nothing further to do. We check twice a day whether your identity provider has published new certificates and update them on our side.

## Federation key rollover

If your identity provider is part of a federation such as DFN AAI, you also don't need to do anything else. We handle the key rollover automatically. As soon as your identity provider has published the certificate in the federation, we update it on our side.

## Service provider (anny) key rollover

As the service provider, we perform the key rollover fully automatically. 14 days before the certificate expires, we create and publish the new certificate. You then receive a notification from us.

As a rule, your identity provider handles these certificates fully automatically. If it doesn't, you need to store the new certificate in your identity provider.