Skip to main content

Search

Pinnacle Series Technical Configuration

Articles about technical configuration of the Pinnacle Series platform

EP background

How To Update an Expiring SAML Signing Certificate for Single Sign On (SSO) App created in Microsoft Azure AD

Applies To: 
 

All organizations utilizing Single Sign On Authentication for access to their Pinnacle web tenant, via the configuration of an Enterprise Application in the Microsoft Azure AD environment.

This article is relevant to organization members with elevated Administrator permissions in the Pinnacle platform to make changes necessary to the update of the Signing Certificate.

The necessary changes to update the signing certificate in the Pinnacle platform will occur in the Administrator Portal (browser-based access). 


Common Causes/Issues:

  • The SAML Signing Certificate in Azure AD is expiring
    • The default max term of expiry is three (3) years

 

Solution Overview:

It will be necessary to access the Enterprise Application created in Azure AD for SSO, and create a "New Certificate" for another chosen term of expiry. 

A new 'Base64 Certificate' can be downloaded from Azure AD, and then 'Browsed For' in the Pinnacle Administration Portal to upload and update.

 

Tactical Rundown:

  1. Within the Azure Portal, navigate to the Enterprise App created for your SSO Authentication
    1. Under 'Manage' in the left margin menu, navigate to 'Single Sign On'
      1. Click the 'Edit' pencil in Box #3 (SAML Signing Certificate)
      2. Click "+New Certificate"
        1. Confirm the 'Expiration Date' and 'Notification Email Address(es)'
      3. Click "Save" 
      4. Click on the three-dot ellipsis to the right of the newly created certificate
        1. Click 'Base64 certificate download' from the list

          mceclip1.png
           
    2. Navigate to the 'Configure SAML' interface within the Pinnacle Platform Administrator Portal.
      1. Administrator Portal -> Security & Authentication tab -> SAML radial button -> 'Configure' button
      2. "Browse" to your network location of the downloaded Base64 certificate
        1. Click 'Save' once selected
        2. Click 'OK' in the Configure SAML interface to update the Base64 certificate


          mceclip3.png

 

Still Need Help?

Log a support ticket