The short answer: When Proof rotates its SAML certificate, most organizations don't need to do anything, because their identity provider (IDP) reads the new certificate from Proof's metadata URL. If you uploaded a certificate to your IDP yourself, you need to add Proof's new certificate there.
Check Which Setup You Have
Automatic update: your IDP uses Proof's metadata URL +
If your IDP is set up with the Proof SP metadata URL, https://api.proof.com/saml/metadata, it picks up the new certificate on its own.
You don't need to do anything, and nothing changes in Command Center.
Manual update: you uploaded a certificate or metadata file +
If you uploaded a certificate or a metadata file to your IDP, it keeps using the certificate you uploaded. Follow the steps in the next section to add the new one.
Update a Certificate You Uploaded
Get the new certificate
Open the Proof SP metadata URL, https://api.proof.com/saml/metadata, in your browser. It lists Proof's current certificate and the upcoming one. Copy or download the new certificate. Fairfax organizations use https://api.fairfax.proof.com/saml/metadata.
Add it to your IDP
In your IDP's configuration for Proof, add the new certificate. If your IDP lets you keep more than one certificate, leave the current one in place until you've confirmed that login works.
Tell Proof you've updated
Submit a support request with your organization name and the IDP you use. Proof moves your organization to the new certificate once you let us know. Organizations that haven't been moved are switched at the final cutoff, so update before then.
Test your login
Open Proof, enter your work email, and confirm you're sent to your IDP and back. Then try signing in from your IDP's Proof app tile.
If Login Fails After the Update
Signing in from your IDP works, but signing in from Proof doesn't +
Your IDP isn't accepting the new certificate for the sign-in requests Proof sends. Confirm that the new certificate is saved and active in your IDP, then test again.
Until it's fixed, users can start from their IDP's Proof app tile.
Signing in fails from both places +
Submit a support request and include the error message, the time it happened, and the IDP you use.
Someone needs access right now +
Users on your SSO exemption list can always sign in with a password. See Manage SSO Exemptions in Command Center.
Summary Checklist
- If your IDP uses Proof's metadata URL, the new certificate is picked up automatically.
- If you uploaded a certificate, get the new one from Proof's SP metadata URL and add it to your IDP.
- Let Proof know once you've updated, so we can move your organization to the new certificate.
- Test signing in from Proof and from your IDP.
Updated