Skip to main content

Configure SAML certificate requests

Before you begin

  • Have SAML enabled for your account.

  • Have your IdP metadata (dynamic or static).

  • Have the field mappings configured in the SAML assertion.

See SAML certificate request prerequisites and the Field Mappings expected from SAML assertion section in SAML certificate requests service workflow.

Configure SAML certificate requests

  1. Go to the Federation Settings page

    1. In the sidebar menu, click Settings > SAML Certificate Requests.

    2. On the SAML Certificate Requests page, click Edit Federation Settings.

  2. Verify your IdP's metadata

    On the Federation Settings page, in the Field Mapping section, verify that you've supplied the specified SAML attributes in your SAML assertation. See the Field Mappings expected from SAML assertion section in SAML certificate requests service workflow.

  3. Set up your identity provider metadata

    On the Federation Settings page, in the Your IDP's Metadata section, complete the tasks below:

    1. Add IdP metadata

      Under How will you send data from your IDP?, use one of these options to add your metadata:

      1. XML Metadata

        Provide DigiCert with your IdP metadata in XML format.

        If your IdP metadata changes, you'll need to manually update your IdP metadata in your account.

      2. Use a dynamic URL

        Provide DigiCert with the link to your IdP metadata.

        If your IdP metadata changes, your IdP metadata is updated automatically in your account.

    2. Add federation name

      Under Federation Name, enter a federation name (friendly name) to be included in the SP-initiated SAML certificate request URL that is created. You will send this URL to your SAML users.

      The federation name will also be in the title of your SP-initiated Certificate Request sign-in page.

      Note

      The federation name must be unique. We recommend using your company name.

    3. Include Federation Name

      By default, we add your Federation Name to the IdP Selection page where your SSO users can easily access your SP Initiated Custom SSO URL for your SAML certificate requests.

      To keep your Federation Name from appearing in the list of IdPs on the IdP Selection page, uncheck Add my Federation Name to the list of IdPs.

    4. Enable client certificates for SAML certificate requests

      Under Product Options, select the types of client certificates you want your SAML users to order, once authenticated to SAML certificate request:

      1. Digital Signature Plus (client authentication + email signing + document signing)

      2. Authentication Plus (client authentication + document signing)

      3. Premium (client authentication + email encryption + email signing + document signing)

      4. Authentication Only (client authentication)

    5. When you are ready, click Save & Finish.

  4. Add the DigiCert service provider (SP) metadata

    On the SAML Certificate Request page, in the DigiCert’s SP Metadata section, complete one of these tasks to add the DigiCert SP metadata to your IdP's metadata:

    • Dynamic URL for DigiCert's SP metadata

      Add the dynamic URL provided by DigiCert to our SP metadata to your IdP to help make the SAML certificate request connection.

      Note

      If the DigiCert SP metadata ever changes, your SP metadata is updated automatically in your IdP.

    • Static XML

      Add the XML formatted SP metadata provided by DigiCert to your IdP to help make the SAML certificate request connection.

      Note

      If the DigiCert SP metadata ever changes, you'll need to manually update in your IdP.

  5. Sign in and finalize the SAML authenticated certificate requests connection

    On the SAML Certificate Request page, in the SAML Certificate URL section, copy the URL and paste it into a browser. Then, use your IdP credentials to sign in and authenticate to SAML certificate requests.

    Tip

    You can use an IdP initiated login URL to sign in to your SAML certificate request instead. However, you need to provide your SAML users with this IdP initiated URL or application.

What's next?

You can now share the SAML certificate request URL and allow your non-CertCentral users to order their client certificates. Share these instructions with SAML users or send them with the SAML certificate requests URL.

In this section: