The identity provider certificate or certificate chain will expire.

Available Languages

Updated:September 29, 2026

Document ID:SPLK048558

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Applicability

Splunk Cloud Splunk Enterprise

Description

In the Splunk Search Head under messages, there is a warning saying the identity provider (IdP) certificate will expire:

The identity provider certificate or certificate chain name=<IdP details> will expire in <number of day> day(s). Update the certificate(s) before they expire to avoid losing access to this instance.

Investigation

Verify the Splunk Search Head is configured with SAML Authentication method under Settings > Authentication methods > Configure Splunk to use SAML > SAML Configuration.

Resolution

Reach out to the IdP administrator and communicate that the IdP certificate is near the expiration date.

Once the certificate is renewed, provide the new certificate in the Search Heads configured with SAML Authentication under Settings > Authentication Methods > Configure Splunk to use SAML.

This can be done with a new Metadata XML File from the Identity Provider (IdP), or using the IdP certificate chains box under the General Settings section of the SAML configuration dialog box. The text here represent one or more IdP certificates chained together. Certificate chains must be in order, starting with the root certificate, any intermediate certificates, and finally leaf certificates. Paste the entire certificate chain into the field. The chain can be comprised of a single certificate as well.

Configure single sign-on using SAML as an authentication scheme.