Replacing an SSO certificate

For production SSO, open School Dashboard → Settings → Authentication. Use Configure SSO in WorkOS for a WorkOS-managed connection. For a legacy SAML connection, update Certificate in PEM format and click Save Authentication Settings. Test sign-in after the change.

SSO is available only in GiveCampus production. SSO is not available in Sandbox and cannot be enabled there. This applies to both WorkOS and legacy SAML. Production SSO setup instructions do not apply to Sandbox.

Authorized institution administrators can use Authentication Settings. For an existing legacy SAML connection owned by this school, replace Certificate in PEM format with the new valid X509 certificate and save. For WorkOS-managed SSO, use Configure SSO in WorkOS and manage certificates there. A shared/inherited identity provider may be managed by another institution; involve its owner or support when editing is unavailable. Coordinate certificate rollover and test login with the identity-provider administrator.