Stay ahead of SSO Certificate expiration in your SSO On-Prem installation
Customers who use SSO On-Prem (self-hosted version of SSO Connect), please read this important notice. Action is required on an annual basis, depending on the date of your SSL certificate expiration.
As outlined in the SSO Connect On-Prem documentation, the installation of the on-prem service requires the creation of an SSL certificate that is used for signing SAML requests and encrypting SAML assertions. This certificate is also used to protect the SSL communications on the service itself.
The Identity Provider (IdP) uses the certificate for verifying the SAML request, and for signing SAML assertions. During the configuration of the Keeper application in the identity provider, you have to upload the Keeper SP metadata to provide the IdP with the certificate.
SSL certificates typically expire after 1 year. Many identity providers such as AD FS will throw errors when the Service Provider (SP) certificate has expired.
Therefore, it's important that customers using SSO On-Prem follow the below best practices:
The private key, CSR, certificate and intermediate certificates generated during the setup process should be backed up in your Keeper vault.
Exactly one year after your certificate is issued, it will expire. Therefore we recommend putting a calendar reminder to renew the certificate. Renewing the certificate is typically automatically performed by the SSL certificate provider. The new certificate file is provided to you along with the latest intermediate certificate chain.
The expiration date of the certificate can be checked a few different ways:
From the SSO Connect On-Prem application user interface
From the certificate file using openssl
From the .pfx file using openssl
The command below will extract the cert from the .pfx file and then display the expiration date.
From your local on-prem SSO Connect instance, open the configuration screen at http://127.0.0.1:8080/config/
Login with your Keeper Administrator account
On the "Status" screen, see the expiration date listed
Before the SSL Certificate expires, it's important to renew the certificate from your provider. Many of the SSL certificate providers will automatically renew and issue you an updated certificate. It is not necessary to re-key it. Simply load the new renewed certificate that has the existing private and public key.
The certificate provider will give you a zip file that contains the .crt
certificate and .ca-bundle
intermediate certificate chain. You will have the original .key
private key file from the original certificate generation in the prior year.
Hopefully you stored your private .key file in your Keeper vault. If you lost your private key, you'll need to create a whole new certificate following our Create Certificate instructions page
To update Keeper SSO Connect, the certs needs to be converted to .pfx
format. From the OpenSSL Command Prompt in the same folder as the .key
, .crt
and .ca-bundle
file, run the below command.
In this example...
keeper.mycompany.com.key
is the private key generated in step 1.
keeper.mycompany.com.crt
is the signed certificate delivered in step 3.
keeper.mycompany.com.ca-bundle
is the CA bundle containing intermediate and root public certificate chains
keeper.mycompany.com.pfx
is the pkcs12 output file used by SSO Connect that has been encrypted with a password.
Make sure to save all 4 files and the generated strong password in your Keeper Vault. Note: The generated key password should not contain special characters.
You will need this password when importing the PFX file into Keeper SSO Connect Interface.
In SSO Connect On-Prem, click “⚙️Configuration”
Drag or upload the .pfx file you just generated into SSO Connect:
Click “Save” in the upper right hand corner of SSO Connect and your certificate configuration should be complete.
After a minute, the service should update and the certificate expiration date should change. Once this is complete, please check the end-user login flow to ensure that the SSO login works.
If you can't login to the Admin Console, please open a support case and we'll assist you.
If you require assistance, please open a support ticket at the link below:
Ensure that you are logging in as a Keeper Administrator with privileges to manage SSO.
Use an account that is in the root node of the enterprise tenant and logs in with a Master Password. SSO Connect On-Prem interface does not allow login with SSO. It is important that all customers using SSO Connect have a service account or administrative account that exists outside of the SSO context.
If you are still unable to login, please locate another Admin in your organization that has the ability to login with a Master Password.
Instructions on SSO certificate renewal in July 2023
Please read this document, as it affects Enterprise customers who use Keeper SSO Connect Cloud with certain identity providers.
Note: Nothing needs to change on the Keeper side. Do NOT reconfigure your Keeper SSO settings. DO NOT delete anything. The only action you may need to take is updating Keeper's certificate on your identity provider.
On July 20, 2023 at 12:18 PST, Keeper's current Cloud SSO Certificate used for signing SAML requests is expiring. This is referred to as the Service Provider (SP) Certificate (Not the IdP Cert).
We have published a new Service Provider Certificate which is live and available for you to download. The certificate is embedded in the XML metadata file and also available as a direct download "Export SP Cert" from the Keeper Admin Console.
Customers using basic configuration in Azure, Okta, Google are NOT Affected.
If you use Keeper Automator alongside SSO Cloud, you are NOT Affected and you do not need to update the certificate, as this is handled by the cert you added to Automator.
If you are using SSO On-Prem you are NOT Affected.
If you are using ADFS with Cloud SSO Connect (without Automator), you are affected.
If you are using Ping Identity (without Automator), you are affected. Read instructions below.
If you use Okta with SLO (Single Logout) activated, you are affected. Read instructions below.
If you use JumpCloud (without Automator), you are affected. Read instructions below.
If you are using service provider-initiated SLO (Single Logout) then you are affected.
If you have a configuration on your identity provider where they are encrypting the SAML assertion with our certificate, you will be affected -- if the identity provider refuses to encrypt with an expired cert.
Other identity providers may reject requests when the cert has expired.
If you don't know, please ensure you're available on July 20 to perform the update in case your identity provider rejects authentication.
You can simply update the "Service Provider Certificate" in your identity provider (by uploading Keeper's Service Provider metadata or Service Provider Certificate). This can be done right now.
The metadata and SP Cert are available from the Keeper Admin Console as seen below:
Important: Ensure that you have the ability to login to the Admin Console with an account and a Master Password that exists outside of the SSO node, in case your SSO is unavailable or affected by the expired certificate.
Updating the certificate only takes a few minutes.
To update the service provider certificate on ADFS, please follow the below steps:
Login to the Keeper Admin Console
Go to Admin > SSO Node > Provisioning and then view the SSO Cloud configuration.
Click on "Export SP Cert" and save the certificate file.
In the AD FS Management Console select the Keeper Cloud SSO Relying Party Trust properties.
On the "Encryption" tab, replace the old certificate with this new cert.
On the "Signature" tab, Add/Replace the new SP certificate with this new cert.
Azure does not appear affected by the certificate expiration, but updating the metadata is simple.
Go to Azure Portal > Enterprise Applications > Keeper Password Manager > Single Sign-On
Click "Upload metadata file" at the top.
Select the metadata xml file that was downloaded from Keeper.
Click Save
Only if you have enabled Single Logout enabled with Okta...
Login to the Keeper Admin Console
Go to Admin > SSO Node > Provisioning and then view the SSO Cloud configuration.
Click on "Export SP Cert" and save the certificate file.
Go to Okta Admin Portal > Applications > Keeper > Sign On tab
If you have "Enable Single Logout" enabled...
Click Edit and Upload the SP Cert from Keeper and click Save
If you don't have Single Logout enabled, there's nothing to do.
Login to the Keeper Admin Console
Go to Admin > SSO Node > Provisioning and then view the SSO Cloud configuration.
Click on "Export SP Cert" and save the certificate file.
Go to the JumpCloud Admin Portal and go to SSO
Open the Keeper Application > SSO Tab
Click on "Replace SP Certificate" and select the new SP Certificate file. (NOT the IdP Cert!)
Login to the Keeper Admin Console
Go to Admin > SSO Node > Provisioning and then view the SSO Cloud configuration.
Click on "Export SP Cert" and save the certificate file.
Login to your Ping Identity portal.
Their notification center will notify you which certificates are expiring.
In the Ping portal, open the Keeper application
Update the "Verification Certificate" and the "Encryption Certificate".
(Alternatively, just upload the new Keeper metadata)
Login to the Keeper Admin Console
Go to Admin > SSO Node > Provisioning and then view the SSO Cloud configuration.
Click on "Export SP Cert" and save the certificate file.
Click on "Export Metadata" and save the metadata file, which also contains the certificate.
Login to your Identity Provider portal and view the SSO configuration for Keeper.
Upload Keeper's SP certificate file (or metadata, if required) following their instructions to update the Service Provider certificate and Save.
If you can't login to the Admin Console, please open a support case and we'll assist you. Make sure to provide all the relevant information about your identity provider and your environment.
If you require assistance, please open a support ticket at the link below:
Q: Which certificate is updating?
A: Our SAML signing certificate for sso.keepersecurity.com has been renewed. The new certificate is now live and will be used for signing all requests until July 2024. This certificate is used for signing requests, sending Single Logout (SLO) requests and can be used to encrypt assertions from the Identity Provider (if configured that way).
Q: Are we affected?
A: In the document above, we identify which customers are affected. If you don't know, you should probably go ahead and update the certificate now, while the old cert is still valid. This is best practice.
Q: Is the key changing?
A: No, we are not re-keying the cert. The current certificate is simply being renewed. The public key does not change, only the expiration date of the cert.
Q: Why is this happening?
A: All certificates have to be renewed annually. Since 2020, public CAs have required that certificates must be renewed once per year (even if a multi-year certificate is purchased).
Q: Is SSO Connect On-Prem affected?
A: No, this only affects customers using SSO Connect Cloud.
Q: Why are we not affected if we use Automator?
A: When you set up Automator, the certificate used for signing comes from the Automator configuration, not from Keeper's certificate.
Q: How do we set up Automator?
A: The Keeper Automator service information is available here: https://docs.keeper.io/sso-connect-cloud/device-approvals/automator Keep in mind, Automator also requires a certificate that must be updated annually. It's just on a different time interval.