KB-1459 How to update the Service Provider signing certificate in the Administration Console

Purpose

The following steps will need to be performed in the Appian Administration Console when updating the Service Provider signing certificate.

Instructions

The following steps should be attempted on a non-production environment first, before making the changes on production.

Appian 25.1 and later

1. Obtain a new signing certificate in a .pem format that contains both the certificate and a private key. See KB-1108 for steps on how to generate a self-signed certificate in the required format.
2. Log into Appian as the System Administrator and navigate to Administration Console > Single Sign-On > SAML.
3. Delete the existing Service Provider Signing Certificate and upload the new one from Step 1.
4. Enter the certificate password if necessary.
5. Download the new Service Provider metadata file from the Administration Console. Use the downloaded metadata to update the connection settings in the IDP.
6. Test the settings by clicking “TEST THIS CONFIGURATION”, and a new window/tab will be redirected to the IDP login page. Enter the credentials for the same user in Appian. 
7. When the authentication is successful, close the test window and click on “TEST COMPLETED”.
8. If the System Administrator performing the above steps is part of the SAML authentication group configured or, there is no SAML authentication group configured, the user will be required to click “VERIFY MY ACCESS” prior to saving changes. For more information on verifying access, please refer to the documentation linked here.
9. Click “SAVE CHANGES” to complete the update

Appian 24.4 and earlier

1. Obtain a new signing certificate in a .pem format that contains both the certificate and a private key. See KB-1108​​​​​​​ for steps on how to generate a self-signed certificate in the required format.
2. Log into Appian as the System Administrator and navigate to Administration Console > Authentication > SAML.
3. Delete the existing Service Provider Signing Certificate and upload the new one from Step 1.
4. Enter the certificate password if necessary.
5. Download the new Service Provider metadata file from the Administration Console. Use the downloaded metadata to update the connection settings in the IDP.
6. Test the settings by clicking “TEST THIS CONFIGURATION”, and a new window/tab will be redirected to the IDP login page. Enter the credentials for the same user in Appian. 
7. When the authentication is successful, close the test window and click on “TEST COMPLETED”.
8. If the System Administrator performing the above steps is part of the SAML authentication group configured or, there is no SAML authentication group configured, the user will be required to click “VERIFY MY ACCESS” prior to saving changes. For more information on verifying access, please refer to the documentation linked here.
9. Click “SAVE CHANGES” to complete the update

Affected Versions

This article applies Appian 7.11 and later.

Last Reviewed: August 2026