Login.gov 2025 SAML certificate rotation

[btylerburton]

Annual Login.gov SAML certificate rotation needs to be done by March 2025. The 2024 certificates expire on April 1, 2025.

Sketch

Follow steps describe in wiki Login.gov SAML certificate rotation steps and notes from previous year.

• Generate new SP certificates.

The following two steps should be done at about the same time to minimize app authentication down time.

• Update development IdP metadata URL in the code, update private keys in the CF environment.
• Update public certs for development apps in login.gov sandbox dashboard.

The following two steps should be done at about the same time to minimize app authentication down time.

• Update staging and prod IdP metadata URL in the code, update private keys in the CF environment.
• Update public certs for staging/prod in the mirrored apps in login.gov sandbox dashboard, submit change requests to have the mirrored apps promoted, make sure they are deployed.