Certificates for SAML federations

Last update: October 05 2026Open in Markdown

Two types of certificates are used when working with federations:

• identity provider certificate — a certificate that is issued on the identity provider side and added when configuring a federation in the control panel. The federation will not work without a certificate;
• request signing certificates — an optional certificate that is issued on the Selectel side if the federation has the Sign authentication requests checkbox selected.

Identity provider certificates

You issue a certificate with the identity provider and add it to the federation in Selectel. The certificate is used to verify data authenticity during user authentication in the control panel.

You can create a federation without a certificate and add it later, but a federation will not work without a certificate. You can add up to 10 certificates for one federation.

If a federation has multiple certificates, they will be applied sequentially: if a certificate has expired or is invalid, the next uploaded certificate will be applied.

Issue a certificate with an identity provider

Keycloak

1. In the Keycloak control panel, go to Realm settings → Keys tab.
2. In the RS256 row, click Certificate.
3. Copy the certificate.

AD FS

1. On the AD FS server, open Server Manager.
2. From the Tools menu, select AD FS Management.
3. Open the folder Services → Certificates.
4. Right-click the Token-signing block → View Certificate.
5. Open the Details tab.
6. Click Copy to file → Next.
7. Select the Base-64 encoded X.509 (.CER) format.
8. Click Next.
9. Enter a name for the certificate file and select a folder on your device where the file will be saved.
10. Check the settings.
11. Click Next.
12. Click Finish.
13. Open the file and copy the certificate contents.

Add certificate

1. In the control panel, in the top menu, click IAM.
2. Go to Federations.
3. Open the federation page → Federations tab.
4. In the IdP certificates block, click Add certificate.
5. Enter the certificate name.
6. Paste the certificate. It must start with -----BEGIN CERTIFICATE----- and end with -----END CERTIFICATE-----.
7. Click Add.

Delete certificate

1. In the control panel, in the top menu, click IAM.
2. Go to Federations.
3. Open the federation page → Federations tab.
4. In the IdP certificates block, in the certificate row, click .

Certificates for signing requests

A request signing certificate is generated automatically on the Selectel side if the federation has the Sign authentication requests option enabled.

You can download the certificate and upload it when configuring the federation on your identity provider's side; for more information, see the Create a SAML federation for Keycloak and Create a SAML federation for AD FS instructions.

Download certificate for signing requests

1. In the control panel, in the top menu, click IAM.
2. Go to Federations.
3. Open the federation page → Federations tab.
4. In the Sign authentication requests field, click Download certificate. The certificate file in .crt format will be downloaded to your device.