On-Prem SSO Certificate Renewal
Stay ahead of SSO Certificate expiration in your SSO On-Prem installation
Customers who use SSO On-Prem (self-hosted version of SSO Connect), please read this important notice. Action is required on an annual basis, depending on the date of your SSL certificate expiration.
Overview
As outlined in the SSO Connect On-Prem documentation, the installation of the on-prem service requires the creation of an SSL certificate that is used for signing SAML requests and encrypting SAML assertions. This certificate is also used to protect the SSL communications on the service itself.
The Identity Provider (IdP) uses the certificate for verifying the SAML request, and for signing SAML assertions. During the configuration of the Keeper application in the identity provider, you have to upload the Keeper SP metadata to provide the IdP with the certificate.
SSL certificates typically expire after 1 year. Many identity providers such as AD FS will throw errors when the Service Provider (SP) certificate has expired.
Therefore, it's important that customers using SSO On-Prem follow the below best practices:
Back Up the Certificate and private key
The private key, CSR, certificate and intermediate certificates generated during the setup process should be backed up in your Keeper vault.
Plan for Certificate Renewal
Exactly one year after your certificate is issued, it will expire. Therefore we recommend putting a calendar reminder to renew the certificate. Renewing the certificate is typically automatically performed by the SSL certificate provider. The new certificate file is provided to you along with the latest intermediate certificate chain.
The expiration date of the certificate can be checked a few different ways:
From the SSO Connect On-Prem application user interface
From the certificate file using openssl
From the .pfx file using openssl
Finding the certificate expiration using openssl
Finding the certificate expiration from the .pfx file
The command below will extract the cert from the .pfx file and then display the expiration date.
Finding the Certificate Expiration on the SSO Connect Gui
From your local on-prem SSO Connect instance, open the configuration screen at http://127.0.0.1:8080/config/
Login with your Keeper Administrator account
On the "Status" screen, see the expiration date listed
![](https://docs.keeper.io/~gitbook/image?url=https%3A%2F%2F1549319098-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252F-LSGErxSfzX6xZALob42%252Fuploads%252F6UTtHy9TZZPuPSS6oWE1%252FScreenshot%25202022-08-10%2520at%25206.40.30%2520PM.png%3Falt%3Dmedia%26token%3Dd2820c5a-8d41-4d46-bf54-7ec9209abb44&width=768&dpr=4&quality=100&sign=bff4bb24&sv=1)
Update the Certificate
Before the SSL Certificate expires, it's important to renew the certificate from your provider. Many of the SSL certificate providers will automatically renew and issue you an updated certificate. It is not necessary to re-key it. Simply load the new renewed certificate that has the existing private and public key.
The certificate provider will give you a zip file that contains the .crt
certificate and .ca-bundle
intermediate certificate chain. You will have the original .key
private key file from the original certificate generation in the prior year.
Hopefully you stored your private .key file in your Keeper vault. If you lost your private key, you'll need to create a whole new certificate following our Create Certificate instructions page
To update Keeper SSO Connect, the certs needs to be converted to .pfx
format. From the OpenSSL Command Prompt in the same folder as the .key
, .crt
and .ca-bundle
file, run the below command.
In this example...
keeper.mycompany.com.key
is the private key generated in step 1.keeper.mycompany.com.crt
is the signed certificate delivered in step 3.keeper.mycompany.com.ca-bundle
is the CA bundle containing intermediate and root public certificate chainskeeper.mycompany.com.pfx
is the pkcs12 output file used by SSO Connect that has been encrypted with a password.
Make sure to save all 4 files and the generated strong password in your Keeper Vault. Note: The generated key password should not contain special characters.
You will need this password when importing the PFX file into Keeper SSO Connect Interface.
Install the Certificate
In SSO Connect On-Prem, click “⚙️Configuration”
![](https://docs.keeper.io/~gitbook/image?url=https%3A%2F%2F1549319098-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252F-LSGErxSfzX6xZALob42%252Fuploads%252F4lbiPsLjc9CvM22rKvS8%252Fsso1.png%3Falt%3Dmedia%26token%3D15443fed-9d5f-4f7c-a070-543184e07fee&width=768&dpr=4&quality=100&sign=52ed9138&sv=1)
Drag or upload the .pfx file you just generated into SSO Connect:
![](https://docs.keeper.io/~gitbook/image?url=https%3A%2F%2F1549319098-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252F-LSGErxSfzX6xZALob42%252Fuploads%252FL9Gx8eGA1Tinbx0rWyfb%252Fsso2.png%3Falt%3Dmedia%26token%3D8b58fdbc-dff2-4513-9997-685f9baa10b3&width=768&dpr=4&quality=100&sign=4e7373e&sv=1)
Click “Save” in the upper right hand corner of SSO Connect and your certificate configuration should be complete.
After a minute, the service should update and the certificate expiration date should change. Once this is complete, please check the end-user login flow to ensure that the SSO login works.
Need help?
If you can't login to the Admin Console, please open a support case and we'll assist you.
If you require assistance, please open a support ticket at the link below:
Troubleshooting
Unable to login to SSO Connect On-Prem
Ensure that you are logging in as a Keeper Administrator with privileges to manage SSO.
Use an account that is in the root node of the enterprise tenant and logs in with a Master Password. SSO Connect On-Prem interface does not allow login with SSO. It is important that all customers using SSO Connect have a service account or administrative account that exists outside of the SSO context.
If you are still unable to login, please locate another Admin in your organization that has the ability to login with a Master Password.
Last updated