Configure Custom Certificates for SAML Authentication in Managed Cloud Enterprise

Strategy (September 2026) adds support for uploading custom certificates for SAML authentication on Managed Cloud Enterprise deployments.

Prerequisites

  • You must have a keystore file in JKS, PKCS12 format.

    Ensure your keystore file contains a private key entry for signing. If your identity provider encrypts SAML assertions, you must also prepare an encryption private key entry.

  • Note your keystore password, each private key entry password, and the exact aliases. Aliases are case-sensitive.

  • Confirm whether your identity provider requires signed authentication requests, encrypted assertions, or both.

Understand Keystores and Certificate Roles

Item Used by Purpose

Keystore

Library A protected container that stores certificate entries and their private keys. Library reads the entries selected by the configured aliases.

Signing certificate

Library to identity provider

Library uses the corresponding private key to sign SAML authentication requests. The identity provider uses the public certificate from the service provider metadata to verify the signature.
Encryption certificate Identity provider to Library The identity provider uses the public certificate in the service provider metadata to encrypt SAML assertions. Library uses the corresponding private key to decrypt the assertions.

The Keystore is the container that holds the certificate entries and private keys. Signing Key Alias specifies the private key entry Library uses to sign SAML authentication requests. Encryption Key Alias specifies the private key entry Library uses to decrypt encrypted SAML assertions. The identity provider never receives the private keys. It receives the corresponding public certificates through the generate service provider metadata.

The Keystore Password opens the container. A Signing Key Password or Encryption Key Password unlocks the corresponding private key entry. The passwords may be identical but they are separate settings.

Configure Custom Certificates

  1. Open the Workstation window.

  2. In the Navigation pane, click Environments.

  3. Right-click an environment, point to Configure Enterprise Security, and select Configure SAML.

  4. In Certificate Source, select Upload.

  5. Click Select a File, find your keystore file, and click Open.

  6. Type your Keystore Password.

  7. Type your Signing Key Alias exactly as it displays in the keystore.

  8. Type your Signing Key Password. This is the password for the signing private key entry.

  9. If the identity provider encrypts assertions, type your Encryption Key Alias and Encryption Key Password. If the identity provider does not encrypt assertions, leave these fields blank.

  10. Enter values in the remaining SAML settings, as needed.

  11. Click Generate Library SPMetadata. Library validates and saves the keystore configuration when it generates the metadata.

  12. Click Complete Configuration.

Upload the Service Provider Certificates to Your Identity Provider

  1. Download the generated service provider metadata file:

    1. Open the Workstation window.

    2. In the Navigation pane, click Environments.

    3. Right-click an environment, point to Configure Enterprise Security, and select Configure SAML.

    4. Next to SPMetadata.xml, click Download.

    5. Close the Configure SAML dialog.

  2. If the identity provider requires the service provider signing certificate, extract it from the <md:KeyDescriptor use="signing"> section using the following:

    1. Locate the <ds:X509Certificate> element within the signing <md:KeyDescriptor>.

    2. Copy the certificate value. The certificate value can be found in the text between <ds:X509Certificate> and </ds:X509Certificate>.

    3. Paste the value into the text editor and if your identity provider expects PEM format, add -----BEGIN CERTIFICATE----- before the value and -----END CERTIFICATE----- after the value.

    4. Save the file with a .cer extenstion. For example, signing-certificate.cer.

    5. Upload the file to your identity provider.

  3. If the identity provider requires the service provider certificate, extract it from the <md:KeyDescriptor use="encryption"> section using the following:

    1. Locate the <ds:X509Certificate> element within the encryption <md:KeyDescriptor>.

    2. Copy the certificate value. The certificate value can be found in the text between <ds:X509Certificate> and </ds:X509Certificate>.

    3. Paste the value into the text editor and if your identity provider expects PEM format, add -----BEGIN CERTIFICATE----- before the value and -----END CERTIFICATE----- after the value.

    4. Save the file with a .cer extenstion. For example, encryption-certificate.cer.

    5. Upload the file to your identity provider.

Troubleshoot Custom Certificates

  • Invalid keystore: Confirm that the uploaded file is the intended keystore and that it uses JKS, PKCS12 format. Verify that the Keystore Password is correct and that the file is not corrupted.

  • Alias not found: List the entries in the keystore and copy the alias exactly, including capitalization.

  • Wrong password for key alias: Enter the password associated with the selected signing or encryption private key entry.

For more SAML configuration information, see Enable SAML Authentication for Strategy Library.