Recently, I got an email from Salesforce, notifying that one of my self-signed certificates is going to expire soon. As a solution to this, I created a new self-signed certificate and replaced the references of old certificate with the new one in all the connected apps, installed packages. I had shared the new certificate with the vendors that are having SSO enabled for Salesforce. However, none of my SSO's are working as they were previously. How do I fix that? Have I missed something really important? Please help.
The article from Salesforce for this is here: https://help.salesforce.com/articleView?id=000182059&type=1
Make sure to install the new cert.
okay, this is rather old post, I would share what I know so far.
In SSO, we have 2 certificates to select:
One: Identity Provider Certificate. As name suggests, it is the certificate issued by your Identity provider, Salesforce is the service provider. This should not be touched and changed at all. Azure for instance: https://azure.microsoft.com/en-us/resources/videos/integrating-salesforce-with-azure-ad-how-to-enable-single-sign-on/
Second: Request Signing Certificate Based on the doc, The certificate used to generate the signature on a SAML request to the identity provider. This signing certificate is used when Salesforce is the service provider for a service provider-initiated SAML login. You save the signing certificate from the Certificate and Key Management Set up page. If you haven’t saved one, Salesforce uses the global proxy certificate. But a signing certificate is preferred because it provides more control over events, such as certificate expiration.
In other words, simply create new request signing certificate and replace the old one in your existing SSO should resolve the issue. There is nothing needs to be done from Identity provider end at all in terms of this scenario.
So why you SSO is not working? I would guess you asked Identity provider to create new SSO instance to salesforce so sth else is changed. If it is just SSO self signed certificate, no need for Identity provider to update anything at all.
Feel free to correct if wrong, thanks