Process – How to Renew the SSO SAML Certificate in FreshService via Entra ID

Every 3 years, the SSO SAML Certificate expires and needs to be replaced with a new one. This Process documents the process in doing this. A notification email from Entra ID will be sent to cybersecurity@mariecurie.org.uk close to the expiry date. Please bear in mind that this process is up to date as of 27/08/2025 and could be slightly different the next time this is done.

Go to Azure -> Entra ID -> Enterprise Apps -> MC Security Services SSO (Production) - GE50 MC Security Services SSO (Production) - GE50 - Microsoft Entra admin center
Go To Single Sign-On

A screenshot of a computerAI-generated content may be incorrect.

Scroll down to 3 – SAML Certificates
Click on Edit

A screenshot of a computerAI-generated content may be incorrect.

Click on “New Certificate”
Use the following settings:
1. Signing Option – “Sign SAML Assertion”
2. Signing Algorithm – “SHA-256”
Click Save

A screenshot of a certificateAI-generated content may be incorrect.

The new SAML Signing Certificate is now generated. You need to do the following:
1. Click on the 3 dots next to the new certificate
2. Now download the certificate by clicking on “Base64 certificate download”

A screenshot of a computerAI-generated content may be incorrect.

9. Open the downloaded certificate with NOTEPAD, and keep this open for later.

Go to Freshservice Admin page Freshworks - Login
Click on Security -> Default Login Methods

A screenshot of a computerAI-generated content may be incorrect.

Scroll down to SSO Login then click on the 3 dots next to “Azure AD (using SAML)” then “Edit SSO”

A screenshot of a login pageAI-generated content may be incorrect.

Scroll down to Certificate (Base 64)
Go back to the Notepad with the opened certificate and copy everything between “-----BEGIN CERTIFICATE-----” and “ -----END CERTIFICATE-----”
Go back to the Freshservice SSO Setup page and paste the new certificate information in Certificate (Base 64)

16. Click on “Configure SSO” to save

A screenshot of a computerAI-generated content may be incorrect.

Go back to the SAML Certificates Edit page in Entra ID
Click on the 3 dots next to the new certificate, then click on “Enable” then “Yes” on the disclaimer

A screenshot of a computerAI-generated content may be incorrect.

19. The SSO SAML Certificate is now updated. Log out and back in to test SSO functionality to confirm.

Useful links:

https://support.freshworks.com/support/solutions/articles/50000002354