Update SSO certificate

You face any of the following issues:

• End users are logged out and can't sign in to the Adobe Creative Cloud web, mobile, or desktop apps.
• When they attempt to sign in, end users see error messages such as the following:
  • SAML certification validation failed.
  • The digital signature in the SAML response did not validate with the identity provider's certificate.
• Admin can't add/remove/manage users or product profiles.
• Admins want to renew your SAML certificate, which is about to expire.

Cause

In a SAML exchange, the two entities that are involved are:

• Identity Provider (IdP)
  IdP certificate is owned and managed by the customer inside their own IdP (ADFS, OKTA, Shiboleth) and is uploaded into the Admin Console.
• Adobe, which acts as a Service Provider (SP)
  Adobe entities are managed in the Admin Console and uploaded to the customer's IdP.

Both entities have their respective certificates, which are used to establish trust.
If you have set up SSO for your identity provider (IdP) with the Adobe Admin Console and your end users cannot log into their Adobe apps and services, the SAML certificate may have expired.

Admin Console notification

Adobe will inform you when an Adobe-generated certificate is set to expire or has expired with a banner notification in the Admin Console along with a status update per directory. To view the status of a SAML certificate, navigate to Settings > Identity Settings and review the Status column of the Directories tab.

Resolution

SAML Setup

If your certificates have expired or are about to expire, you can directly update the federation setup via the Admin Console. The SAML certificates are updated along with the SAML setup.

As a System Admin, you can directly update and manage self-signed certificates from the Admin Console by following these steps:

Once a certificate is successfully created, additional actions will be available, including set as default, activate, deactivate, download metadata, download certificate, and delete.

If your IdP supports multiple certificates, follow these steps without any login interruptions.

If your IdP does NOT support multiple certificates you should pick a downtime interval to perform the renewal:

Audit logs

Actions taken related to the creation and management of certificates can be found in the audit logs.

To view the audit logs, go to the Admin Console and navigate to Insights > Logs > Audit log.