Overview
Ardoq regularly updates its internal security infrastructure, which includes rotating our SAML Service Provider (SP) Encryption Certificate.
This update is a routine maintenance task driven by industry best practices and configuration hygiene. Ardoq natively supports both our previous and newly rotated encryption keys simultaneously, meaning this update will not cause any immediate disruption or forced outages to your user logins.
Does this apply to my organization?
This update only applies to your organization if you have explicitly enabled optional SAML Token/Assertion Encryption within your Identity Provider (IdP) (such as Microsoft Entra ID, Okta, or ADFS).
If your IdP does NOT use token encryption: You can safely ignore this notice. No action is required on your part.
If your IdP DOES use token encryption: We highly recommend updating Ardoq's encryption certificate on your side to keep your corporate environment current and aligned with long-term security standards.
(Note: This rotation is entirely separate from your own IdP signing certificate expiration tasks.)
How to Update the Encryption Certificate
If token encryption is enabled in your IdP, you can perform a clean, zero-downtime swap at your earliest convenience using one of the two methods below to retrieve our new public key:
Method 1: Direct Download (Preferred)
Download the ready-to-upload
.cerfile directly from your organization's specific Ardoq subdomain URL:https://<customer-subdomain>.ardoq.com/saml/encryption-certificate
⚠️ Important Note: Please ensure you use the
/saml/encryption-certificateendpoint. Do not use the/saml/signing-certificateendpoint, as it hosts a completely different key that will not function for token encryption.
Method 2: Extracting from Metadata XML (Fallback)
If your corporate security policies require you to extract certificates directly from raw metadata, you can manually build the file:
Navigate to your metadata endpoint in a browser:
https://<customer-subdomain>.ardoq.com/saml/metadata/v2
Locate the XML element block marked
<KeyDescriptor use="encryption">. (Do not use the block markeduse="signing").
Copy the string of Base64 text inside the
<ds:X509Certificate>element.
Paste that text into a plain text editor, wrap it in PEM headers, and save it locally as a
.ceror.pem
-----BEGIN CERTIFICATE-----<paste your copied Base64 text here>
-----END CERTIFICATE-----