Describes SAML Certificate Renewal Options in Cisco Secure Access. A SAML identity provider (IdP) may require the verification of a service provider's request signing certificate.

A SAML identity provider (IdP) may require the verification of a service provider's request signing certificate. When you integrate a SAML IdP with Secure Access, you may have to import the Secure Access certificate information in to your IdP platform.

Note
Many IdPs do not validate SAML request signatures and therefore these steps are not required. We recommend that you contact your IdP for confirmation.

There are two options for importing the certificate information into your IdP: Automatic Configuration and Manual Import.

Known Limitations

If you have multiple Secure Access organizations and use the Secure Access multiple-Org SAML EntityID, then you must not use the URL-based metadata update mechanism. The Multiple-Org SAML Entity ID only applies if you have multiple Secure Access organizations linked to the same IdP. In this scenario you should manually add the Secure Access request signing certificate to each IdP configuration.

Automatic Configuration Through the Fixed Metadata URL

This option is the preferred configuration method for IdPs that support automatic updates of metadata through an URL. This includes popular IdPs such as AD FS and Ping Identity. The benefit is that the IdP automatically imports a new Secure Access certificate each year without manual intervention.

Prerequisites:

An IdP that supports automatic updates of a service provider's metadata from a URL, for example: AD FS and Ping Identity.

Configure your IdP platform to read one of the Secure Access metadata URLs for encrypted or unencrypted SAML assertions:

Encrypted:

https://api.sse.cisco.com/admin/v2/samlsp/certificates/Cisco_SSE_SP_Metadata_with_Encryption.xml

Unencrypted:

https://api.sse.cisco.com/admin/v2/samlsp/certificates/Cisco_SSE_SP_Metadata.xml

Your IdP platform can read the associated Certificate Authority URLs:
```
http://r3.o.lencr.org
```
```
http://r3.i.lencr.org
```
Your IdP platform must support TLS 1.2 in order to connect to the Secure Access metadata URL securely. If the IdP application utilizes .NET framework 4.6.1 or earlier this may require some further configuration. See Microsoft's documentation.
For information on prerequisites that apply to all SAML IdPs, see Prerequisites for SAML Authentication.

Manual Import of the Secure Access SAML Certificate

Renew Identity Provider Certificates

Navigate to Connect > Users, Groups, and Endpoint Devices > Configuration Management > SSO authentication > select your IdP > Edit > SAML Configuration > click Please upload the XML Configuration file from here. For more information, see Edit an SSO Authentication Profile.

Renew Service Provider Certificates

Navigate to Secure > Certificates > SAML integration > Service Provider certificates > click Download next to any expiring or expired service provider certificate and add it to your IdP to activate.

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.