Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

When accepting public keys from someone setting up an identity provider for access to resources protected by a service provider using SAML 2.0, do you absolutely need to have a unique certificate? Is this covered in the SAML specifications?

If they don't, I assume that use of certificates as a layer of defense is rendered void. An example might be someone setting up a test IdP and reusing the certificate for production.

share|improve this question

It is not specified that the certificates for two idps must be unique. As far as I know you dont even have to have a certificate. But its recommended.

share|improve this answer

To expand on Stefan's answer:

I would also ensure that the certificate used for signing is different than the one used for encryption, as well as different from the one the TLS (I hope you aren't still using SSL) is using to secure the communications channel.

In other words... A unique certificate for each thing.

share|improve this answer
Can you explain why the TLS cert needs to be different from the one used for SAML? – Jens Timmerman Aug 19 '15 at 12:24
It doesn't NEED to be different. I'd just suggest it. That way you can revoke one without affecting the other. It may be rare that you would need to, but, it happens. – Andrew K. Aug 19 '15 at 16:22

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.