---
title: "Certificates for SAML federations"
sidebar_label: "Certificates"
sidebar_position: 3
description: "How to work with identity provider certificates and download a Selectel certificate for signing requests"
---

import Formbricks from '@theme/MDXComponents/Formbricks'
import TrashIcon from '@selectel/docux/icons/trash'
import Tabs from '@theme/Tabs'
import TabItem from '@theme/TabItem'
import {TabItemLabel} from '@selectel/docux/components'

# Certificates for SAML federations

When working with federations, two types of certificates are used:

* [identity provider certificate](#identity-provider-certificates) — a certificate that is issued on the identity provider side and added when configuring a federation in the control panel. Without a certificate, the federation will not work;
* [certificates for signing requests](#certificate-for-request-verification) — an optional certificate that is issued on the Selectel side if the federation has the **Sign authentication requests** checkbox marked.

## Identity provider certificates \{#identity-provider-certificates}

You [issue a certificate](#issue-certificate) from your identity provider and [add it](#add-certificate) to the federation in Selectel. The certificate is used for authenticating data during user login in the control panel.

You can create a federation without a certificate and add one later, but a federation without a certificate will not work. You can add up to 10 certificates for a single federation.

If a federation has multiple certificates, they will be applied sequentially: if a certificate has expired or is invalid, the next uploaded certificate will be used.

### Issue a certificate from an identity provider \{#issue-certificate}

<Tabs queryString="provider">
  <TabItem value="keycloak" default>
    <TabItemLabel>
      Keycloak
    </TabItemLabel>

    1. In the Keycloak control panel, go to the **Realm settings** section → **Keys** tab.
    2. In the **RS256** row, click **Certificate**.
    3. Copy the certificate.
  </TabItem>

  <TabItem value="ad-fs">
    <TabItemLabel>
      AD FS
    </TabItemLabel>

    1. On the AD FS server, open **Server Manager**.
    2. In the **Tools** menu, select **AD FS Management**.
    3. Open the **Services** → **Certificates** folder.
    4. Right-click the **Token-signing** block →  **View Certificate**.
    5. Open the **Details** tab.
    6. Click **Copy to file** → **Next**.
    7. Select the **Base-64 encoded X.509 (.CER)** format.
    8. Click **Next**.
    9. Enter a name for the certificate file and select a folder on your device where the file will be saved.
    10. Check the settings.
    11. Click **Next**.
    12. Click **Finish**.
    13. Open the file and copy the certificate content.
  </TabItem>
</Tabs>

### Add a certificate \{#add-certificate}

1. In the [control panel](https://my.selectel.ru/iam/federations), on the top menu, click **IAM**.
2. Go to the **Federations** section.
3. Open the federation page → **Federations** tab.
4. In the **IdP certificates** block, click **Add certificate**.
5. Enter a certificate name.
6. Paste the certificate. It must start with `-----BEGIN CERTIFICATE-----` and end with `-----END CERTIFICATE-----`.
7. Click **Add**.

### Remove a certificate \{#delete-certificate}

1. In the [control panel](https://my.selectel.ru/iam/federations), on the top menu, click **IAM**.
2. Go to the **Federations** section.
3. Open the federation page → **Federations** tab.
4. In the **IdP Certificates** block, in the certificate row, click <TrashIcon />.

## Certificates for signing requests \{#certificate-for-request-verification}

The certificate for signing requests is automatically generated on the Selectel side if the **Sign authentication requests** option is enabled for the federation.

You can [download the certificate](#download-certificate-for-request-verification) and upload it when configuring the federation on your identity provider's side; for more information, see the [Create a SAML Federation for Keycloak](/access-control/federations/manage-saml/create-saml-federation-keycloak.mdx) and [Create a SAML Federation for AD FS](/access-control/federations/manage-saml/create-saml-federation-keycloak.mdx).

### Download a certificate for signing requests \{#download-certificate-for-request-verification}

1. In the [control panel](https://my.selectel.ru/iam/federations), on the top menu, click **IAM**.
2. Go to the **Federations** section.
3. Open the federation page → **Federations** tab.
4. In the **Sign authentication requests** field, click **Download certificate**. The certificate file in `.crt` format will be downloaded to your device.

<Formbricks />