# About certificate information as IdP using saml2 addon

**URL:** <https://community.auth0.com/t/about-certificate-information-as-idp-using-saml2-addon/120074>\
**Category:** Get Help\
**Tags:** application, addons\
**Created:** [November 2, 2023, 1:03pm UTC](https://community.auth0.com/t/about-certificate-information-as-idp-using-saml2-addon/120074 "2023-11-02T13:03:07Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![yk-ms](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/yk-ms/32/33197_2.png) [@yk-ms](https://community.auth0.com/u/yk-ms)\
**Post date:** [November 2, 2023, 1:03pm UTC](https://community.auth0.com/t/about-certificate-information-as-idp-using-saml2-addon/120074/1 "2023-11-02T13:03:07Z")

</div>

I have created a new App in the Auth0 tenant as IdP in SAML, configured saml2 from addon and provided the certificate to SP as IdP configuration  
As for this small name, is it a self-signed certificate or a legitimate certificate? And is there any expiration date etc.?

---

<div class="post-metadata">

**Author:** ![dan.woda](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dan.woda/32/18340_2.png) [@dan.woda](https://community.auth0.com/u/dan.woda)\
**Post date:** [November 8, 2023, 3:46pm UTC](https://community.auth0.com/t/about-certificate-information-as-idp-using-saml2-addon/120074/3 "2023-11-08T15:46:15Z")

</div>

Hi @yk-ms,

Welcome to the Auth0 Community!

It looks like it’s self-signed according to [this faq](https://community.auth0.com/t/downloaded-signing-certificate-from-the-tenant-showing-same-issuer-and-issuee/107277).

I don’t see anything about an expiration, more info about rotation here: [Tenant Signing Key Rotation](https://community.auth0.com/t/tenant-signing-key-rotation/77626)

---

<div class="post-metadata">

**Author:** ![matt.macadam](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/matt.macadam/32/55188_2.png) [@matt.macadam](https://community.auth0.com/u/matt.macadam)\
**Post date:** [November 8, 2023, 4:54pm UTC](https://community.auth0.com/t/about-certificate-information-as-idp-using-saml2-addon/120074/4 "2023-11-08T16:54:44Z")

</div>

The certificate is “legitimate” in that it’s correctly formed, but it’s not signed by a public CA (i.e. it is self-signed).

Expiration of the certificate is 13 years from tenant creation, or from the most recent tenant signing key rotation (@dan.woda shared a document about signing key rotation).

If you need to sign SAML requests with a key bound to a certificate issued by a public CA [you can do so.](https://auth0.com/docs/authenticate/protocols/saml/saml-sso-integrations/sign-and-encrypt-saml-requests#change-the-signing-key-for-saml-responses). Note this document is a bit out of date and specifies using a rule to set the keypair. You can accomplish the same thing [using actions](https://auth0.com/docs/customize/actions/flows-and-triggers/login-flow/api-object) and the `api.samlResponse.setCert(cert)` and `api.samlResponse.setKey(key)` methods.

---

<div class="post-metadata">

**Author:** ![dan.woda](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dan.woda/32/18340_2.png) [@dan.woda](https://community.auth0.com/u/dan.woda)\
**Post date:** [November 8, 2023, 5:34pm UTC](https://community.auth0.com/t/about-certificate-information-as-idp-using-saml2-addon/120074/5 "2023-11-08T17:34:08Z")

</div>

Thanks for the info @matt.macadam!

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [November 22, 2023, 5:35pm UTC](https://community.auth0.com/t/about-certificate-information-as-idp-using-saml2-addon/120074/6 "2023-11-22T17:35:02Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.