Why is a publicly recognized certificate recommended for SAML authentication in Azure AD B2C ?

Question

SAML authentication is implemented in Azure AD B2C; a certificate must be set up in Azure AD B2C, and the documentation recommends using a certificate issued by a public certificate authority. What is the reason for this?

In a production environment, we recommend using certificates that a public certificate authority has issued. But you can also complete this procedure with self-signed certificates.

There should be no need to externally verify the validity of the certificate in SAML authentication. Also, considering the case where certificates are periodically renewed for security reasons, it seems redundant to use certificates issued by an external public certification authority.

Google Workspace, for example, states in its documentation to use self-signed certificates.

Why does Azure AD B2C recommend using certificates issued by public certificate authorities?

Answer 1

Hi,

I am assuming it is a Microsoft way of giving you an option and preferences as each customers requirements is different and some prefer to use custom/Public Certificates instead of self signed Certificates. I will not go deep into the nitty gritty of Security aspects as with on field experience I have noticed many prefer custom public Certificates instead of self signed ones. However if you feel it is not correct and should be addressed I will suggest you to raise a feedback over here.

Hope this helps.
JS

==
Please Accept the answer if the information helped you. This will help us and others in the community as well.