--- title: "Managing SSO certificates" slug: "managing-sso-certificates" description: "Manage SAML certificate renewals effortlessly with Document360. Monitor expiry dates and download certificates to ensure uninterrupted SSO authentication." updated: 2026-10-12T08:19:48Z published: 2026-10-12T08:19:48Z canonical: "docs.document360.com/managing-sso-certificates" --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.document360.com/llms.txt > Use this file to discover all available pages before exploring further. # Managing SSO certificates Renew your SAML SSO certificate before it expires so that everyone can keep signing in with SSO. When the certificate expires, SSO sign-in fails for all users, and no one can sign in with SSO until the certificate is updated. You can check the expiry date and download the Document360 SSO certificate from the **Enterprise SSO** page, and then upload it to your identity provider (IdP). --- ## When to manage your SSO certificate - A **SAML Certificate Rotation Notice** banner appears on the **Enterprise SSO** page. The banner appears when a certificate is 15 days or less from expiry. - You want to check when the certificate of a SAML configuration expires, so you can plan the renewal. - Your IdP can't read the new certificate automatically from metadata, so you must upload it manually. - SSO sign-in fails with a certificate error, and you want to confirm that Document360 and your IdP use the same certificate. --- ## Before you begin - You need permission to configure SSO in the project. Only people with this permission see the expiry banner. - Make sure you can sign in to your IdP's admin console to update the certificate there. - This article covers SAML configurations. --- ## How to check when your certificate expires You can see the expiry date in two places. **On the Enterprise SSO page** 1. Go to **Settings** () > **Users & Permissions** > **Enterprise SSO**. If a certificate is 15 days or less from expiry, the **SAML Certificate Rotation Notice** banner appears above the SSO configuration list and shows the exact expiry date. ![SAML Certificate Rotation Notice banner above the SSO configuration list, showing the expiry date and the Download certificate button.](https://cdn.document360.io/860f9f88-412e-4570-8222-d5bf2f4b7dd1/Images/Documentation/SSO%20configuration%20-%20SAML%20Certificate%20Rotation%20Notice.png) **In a SAML configuration** 1. Go to **Settings** () > **Users & Permissions** > **Enterprise SSO**. 2. Hover over the SSO configuration and click the **Edit** () icon. 3. Go to the **IdP configurations** tab. The expiry date appears below the certificate information. --- ## How to download and renew the SSO certificate 1. Go to **Settings** () > **Users & Permissions** > **Enterprise SSO**. 2. In the **SAML Certificate Rotation Notice** banner, click **Download certificate**. The certificate downloads to your computer in `.cert` format. 1. In your IdP's admin console, open the Document360 application and upload the downloaded certificate. For where the Document360 application lives in your IdP, see the setup guide for your provider in [SAML](/docs/saml). NOTE - Downloading the certificate doesn't change your existing SSO configuration in Document360. You need the file only to renew the certificate in your IdP. - Each download is recorded in **Settings** () > **Team auditing**, with the timestamp and the admin who downloaded it. To learn more, read [Team auditing](/docs/team-auditing). --- ## Best practices - **Start the renewal when the banner appears.** Don't wait until the certificate expires. SSO fails for all users the moment it does. - **Download the certificate before you update your IdP.** Some IdPs can't read the new certificate automatically from metadata. Download it from Document360 first, and then upload it to your IdP. - **Track renewals in Team auditing.** Every download is logged with a timestamp and the admin who performed it. Use this record to see when the certificate was last rotated. - **Check that both sides use the same certificate.** An untrusted key error or an invalid signature error means the certificate in Document360 doesn't match the one active in your IdP. After you rotate the certificate, test SSO sign-in in a private browser window before you notify users. If sign-in fails, read [SSO login issues](/docs/sso-login-issues) and [SAML SSO issues](/docs/saml-sso-issues). --- ## Related articles SAML Find the SAML setup guide for your identity provider. [Learn more →](/docs/saml) Fix SSO sign-in errors Find the cause and fix for common SSO sign-in errors, including expired certificates. [Learn more →](/docs/sso-login-issues) Team auditing Review who downloaded the certificate and when. [Learn more →](/docs/team-auditing) More on SAML SSO: - [SAML SSO issues](/docs/saml-sso-issues) - [Log in using SSO - Knowledge base portal](/docs/login-using-sso-knowledge-base-portal) --- ## FAQ **What happens if my SAML certificate expires?** SSO sign-in fails for all users, and no one can sign in with SSO until the certificate is updated. Renew it when the SAML Certificate Rotation Notice banner appears, 15 days or less before expiry. **Why can't I see the certificate expiry banner?** The banner appears only when a certificate is 15 days or less from expiry, and only to people with permission to configure SSO. To check the expiry date at any time, open the SAML configuration and go to the IdP configurations tab.