SSO x509 certificate expiration

Urgent action is required if your organization has explicitly enabled signature verification (aka fingerprint verification) for SAML authentication requests using Contentful current x509 certificate. If your organization has not enabled signature verification for SAML authentication requests, then there will be no impact to your service when the new certificate is activated.

You may also find it via https://be.contentful.com/sso/{YOUR-ORGANIZATION-ID}/metadata, where YOUR ORGANIZATION ID is the ID of your organization in Contentful.

To find your organization ID, navigate to the Organization Settings page and look in the browser URL.

Public key:

SHA1 Fingerprint=1E:F9:24:A1:4C:C5:8F:AF:8A:15:4E:75:BC:82:9B:88:5E:A5:D4:55

Only SSO users who have enabled signature verification (aka fingerprint verification) for SAML authentication requests using Contentful’s current x509 certificate will be affected by this change.

Contentful SSO providers who allow signature verification, and therefore could be impacted, are as follows:

• Microsoft Azure.

• miniOrange.

• Ping.

If you use one of the providers listed above and have NOT enabled signature verification, no action is required and the changes will not affect your SSO service for Contentful.

Providers who do not allow signature verification, and therefore will NOT be affected are as follows:

• Okta.

• OneLogin.

You may be able to disable the verification for SAML authentication requests in your Identity Provider admin dashboard. However, we do not endorse or recommend this course of action.

No, this will not affect users who are already signed in to Contentful via SSO.

The only disruption may happen if you put Contentful’s x509 certificate into your Identity Provider system, enabled signature verification, and don’t update the certificate to the new one on/by 1st November: your users will not be able to authenticate, and will receive an authentication error. 

Once the new certificate is in place, go to SSO login page at Contentful (NB go to Contentful page, not your Identity Provider login page) - in an incognito browser window and login to test if the new certificate is accepted to authenticate your log in.