This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(25.6, 28.999999999999996%, 12%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EK%3C/text%3E%3C/svg%3E)
I authenticate an webapp that use SAML auth with X.509 certificate from Azure Enterprise App. It work perfekt, but cert expire after few weeks. How can I change expiring time?
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(153.6, 92%, 24%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EA%3C/text%3E%3C/svg%3E)
@KjoniX , As you have posted the question on Azure App Service, to better assist you on this, are you leveraging Azure App Service WebApp ( see the prerequisite) or for Enterprise app Entra ID ( see Advanced certificate signing options in a SAML token)
Also, kindly let us know if you are referring to any specific Azure doc' for the steps and share additional details about your requirement and issue.
Configure TLS mutual authentication for Azure App Service
Application Management certificates frequently asked questions
We will re-tag/add appropriate tags to receive insights from the targetted audience/SMEs.
From SAML admin, I parse the federationmetadata.xml from enterprise app to this document below.
<?php
$metadata['https://sts.windows.net/0d32092f-883d-47b8-****-b267e6c5ee0d/'] = [
'entityid' => 'https://sts.windows.net/0d32092f-****-47b8-87f0-b267e6c5ee0d/',
'contacts' => [],
'metadata-set' => 'saml20-idp-remote',
'SingleSignOnService' => [
[
'Binding' => 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect',
'Location' => 'https://login.microsoftonline.com/0d32092f-883d-47b8-87f0-b267e6c5ee0d/saml2',
],
[
'Binding' => 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST',
'Location' => 'https://login.microsoftonline.com/0d32092f-883d-47b8-87f0-b267e6c5ee0d/saml2',
],
],
'SingleLogoutService' => [
[
'Binding' => 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect',
'Location' => 'https://login.microsoftonline.com/0d32092f-883d-47b8-87f0-b267e6c5ee0d/saml2',
],
],
'ArtifactResolutionService' => [],
'NameIDFormats' => [],
'keys' => [
[
'encryption' => false,
'signing' => true,
'type' => 'X509Certificate',
'X509Certificate' => 'MIIC/TCCAeWgAwIBAgIICHb5qy8hK****************',
],
[
'encryption' => false,
'signing' => true,
'type' => 'X509Certificate',
'X509Certificate' => 'MIIC/jCCAeagAwIBAgIJAKysonliFZLIMA0GCSqGSIb3DQEBCwUAMC0xKzApBgNV*************',
],
[
'encryption' => false,
'signing' => true,
'type' => 'X509Certificate',
'X509Certificate' => 'MIIC6jCCAdKgAwIBAgIJAMqvEglnjttEMA0GCSqGSIb3DQEBCwUAMCMxITAfBgNVBAMTGGxvZ2luLm1pY3Jvc29md************',
],
],
];
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(246.4, 20%, 33%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ESM%3C/text%3E%3C/svg%3E)
Just checking in to see if the below answer helped. If this answers your query, please don’t forget to click "Accept Answer" and Up-Vote for the same, which might be beneficial to other community members reading this thread. And, if you have any further query do let us know.
Hi @KjoniX ,
Thanks for reaching out.
By default, Microsoft Entra ID configures a certificate to expire after three years when it is created automatically during SAML single sign-on configuration. Because you can't change the date of a certificate after you save it, you need to create a new certificate.
However, if your certificate is about to expire, you can renew the certificate as mentioned https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/tutorial-manage-certificates-for-federated-single-sign-on#renew-a-certificate-that-is-set-to-expire-soon
Hope this will help.
Thanks,
Shweta
Please remember to "Accept Answer" if answer helped you.
I know, but in my case the certificate expires every second month. I don't know why....
Could you please confirm that you are creating application using Entra application gallery?
The recommended way to create SAML applications is through the Microsoft Entra Application Gallery, which will automatically create a three-year valid X509 certificate.
Interesting. I have created a Enterprise Application from scratch and downloaded the federationmetadata.xml from here:
To clarify. I clicked "Create your own application", but you mean that I should choose from gallery applications? I get a lot of 3. party applications when search for "SAML".
The Microsoft Entra application gallery is a collection of software as a service (SaaS) applications that are pre-integrated with Microsoft Entra ID. I understand that the collection contains thousands of applications that make it easy to deploy and configure SSO and user provisioning.
From the lot, you can choose Microsoft Entra SAML Toolkit to integrate SAML with Entra ID.
Thanks,
Shweta
Please remember to "Accept Answer" if answer helped you.
Spot on Shweta. Thanks!!!