Configure single sign-on with SAML
To streamline the process, we recommend keeping two browser tabs open: one for )DigiCert® account and another for your Identity Provider (IdP). This setup allows you to easily reference both platforms and complete the configuration without interruptions.
Prerequisites
Before configuring SAML in DigiCert® account:
Have administrator access to your company's IdP service, such as Active Directory, Okta, Salesforce, or other user management service.
Make sure authentication from your IdP signs the response and the assertion.
Have your IdP metadata and SAML certificate.
To enable and configure SSO with SAML
Sign in to your DigiCert® account.
In the DigiCert account menu, go to Accounts icon > Sign-in methods.
Select Single-Sign-On with SAML.
In the Connect DigiCert to your IdP section, upload the DigiCert metadata to your IdP to enable your IdP to communicate with DigiCert for SAML authentication.
Select Download DigiCert metadata.
In the Connect your IdP to DigiCert section, upload your IdP metadata (including the SAML certificate) to allow DigiCert to communicate with your IdP for SAML authentication.
Once both steps are completed, in the Enable/Disable SSO with SAML section, toggle to enable SSO with SAML.
Select Save configuration.
Troubleshooting
To configure SSO with SAML, you'll need to create DigiCert® account an application in your IdP. During the process of creating this application, you'll need to provide DigiCert's metadata. Once the application is created, you can download your IdP metadata that you'll need to provide to DigiCert® account.
Tip
To perform this action, you must be an admin in your IdP.
Sign in to your Okta Admin dashboard
Go to Applications > Applications.
Select Create App integration:
Select SAML 2.0 as the Sign-on method.
Select Next.
Enter DigiCert® account as the App name.
Optional: Add a logo to the App logo field.
Switch to your DigiCert® account tab:
Copy the SSO URL.
Switch to your Entra tab:
On the Configure SAML tab, complete the following fields:
Paste the SSO URL from DigiCert account in both of the following fields:
Single sign-on URL
Audience URI (SP Entity ID)
In the Name ID Format field, select Email address.
In the Application username field, select Email.
Select Next.
Select Finish.
On the Sign On tab, select View SAML setup instructions.
In the Optional section, copy the IdP metadata.
Paste the IdP metadata into a notepad and save the file in
.xmlformat.Switch to your DigiCert® account tab:
In the Connect your IdP to DigiCert section, select Upload metadata.
In the Enable/Disable SSO with SAML section, toggle to enable SSO.
Select Save configuration.
Note
For more information, refer to Okta Help Center.
Sign in to the Microsoft Entra admin center.
In the left-hand navigation menu, navigate to Microsoft Entra ID > Manage > Enterprise applications.
Select New application.
In the Search application field, enter DigiCert.
Select the application for DigiCert, Inc.
Optional: If you have multiple DigiCert SAML applications, in the Name field, change the name to DigiCert account.
Select Create.
Select the DigiCert account application you just created.
From the application's overview, select Assign users and groups.
This list displays users already assigned to the application.
To add additional users, select +Add user/group.
From the application's overview, in the left hand menu, select Manage > Single sign-on.
In the SAML Certificates section, select Download next to Federation Metadata XML.
Switch to your DigiCert® account tab:
In the Connect your IdP to DigiCert section, select Upload metadata.
In the Connect DigiCert to your IdP section, select Download DigiCert metadata.
In the Enable/Disable SSO with SAML section, toggle to enable SSO.
Select Save configuration.
Switch to your Entra tab:
Select Upload metadata file.
Note
For more information, refer to Microsoft Learn.
Sign in to the Google Admin console.
In the left-hand navigation menu, navigate to Apps > Web and mobile apps.
In the App name field, enter DigiCert account.
In the Description field, enter a custom description.
Example: DigiCert's single login experience
In the App icon field, upload the DigiCert icon.
Select Continue.
In the Download IdP metadata section, select Download metadata.
Select Continue.
Switch to your DigiCert® account tab:
In the Connect your IdP to DigiCert section, select Upload metadata.
In the Connect DigiCert to your IdP section, copy the SSO URL.
In the Enable/Disable SSO with SAML section, toggle to enable SSO.
Select Save configuration.
Switch to your Google Workspace tab:
Paste SSO URL in both of these fields:
ACS URL
Entity URL
In the Name ID format field, select Email.
In the Name ID field, keep the default Basic information > Primary email.
Select Continue.
In the Attributes section, select Add mapping.
Below the Google Directory attributes field, select Primary email.
Below the App attributes field, type email.
Select Finish.
Note
For more information, refer to Google Workspace.
Two-Factor Authentication and SSO with SAML
When 2FA is enabled, DigiCert will prompt you to enter an OTP when signing in, even if you have already provided an OTP to your identity provider (IdP).