We are implementing SAML/OIDC-based SSO across our enterprise and wanted to get a feel for best practices when it comes to using Personal/Signer Certificates within our IdP.
Historically we've utilised the personal certificate that came with our IdP, but upon reading their documentation, it seems as though they recommend against that and state that is there for demonstration purposes only.
I'm looking for feedback from SMEs on whether:
- Do you utilise self-signed certificates?
- Or, have you traditionally gone to CAs for your signer certificates?
- If "yes" to #2, what is your CA of choice for signer certificates?
- If "yes" to #1, what is the length of validity you typically use for your self-signed certificates?
Any feedback on this would be greatly appreciated.