Overview
SAML signing certificates are used by your Identity Provider (IdP) to sign assertions. Fabriq relies on these certificates to validate incoming SAML responses and ensure they are trusted.
When your IdP rotates its signing certificate, Fabriq must also trust the new certificate. Whether this happens automatically or requires manual action depends entirely on how your SSO configuration is set up in Fabriq.
There are two supported configurations:
Dynamic (metadata URL) → automatic certificate rollover
Static (uploaded metadata or XML) → manual update required
How to Identify Your Configuration
Go to:
Organization Settings → Security → SSO
If you see a metadata URL → your setup is dynamic (automatic rollover)
If you see an uploaded file or XML block → your setup is static (manual updates required)
1. Metadata URL (Dynamic, Automatic Rollover)
If Fabriq is configured with a remote metadata URL pointing to your IdP’s metadata endpoint, certificate rollover is handled automatically.
Fabriq periodically fetches the metadata and updates trusted signing certificates from the <ds:X509Certificate> elements.
Why this is recommended
This is the preferred configuration because:
No manual action is required during certificate rotation
Supports zero-downtime rollover
Compatible with IdPs that publish multiple certificates simultaneously
(e.g., Microsoft Entra ID dual-certificate overlap)
Sync schedule
Fabriq polls the metadata URL every 6 hours, anchored at midnight UTC:
UTC | CET (UTC+1) | CEST (UTC+2) |
00:00 | 01:00 | 02:00 |
06:00 | 07:00 | 08:00 |
12:00 | 13:00 | 14:00 |
18:00 | 19:00 | 20:00 |
Important considerations
Fabriq may continue using the previous certificate for up to 6 hours after your IdP switches to a new one.
To avoid authentication failures:
Rotate the certificate before the old one expires, with sufficient overlap
OR enable your IdP’s dual-certificate / overlap mode (strongly recommended)
2. Static Metadata (Manual Update Required)
If Fabriq is configured using:
an uploaded metadata file, or
pasted XML metadata
then the signing certificate is stored statically.
Fabriq does not automatically detect certificate changes. You must manually update the metadata whenever the IdP rotates its certificate.
Update procedure
Rotate the SAML signing certificate in your IdP
(e.g., Microsoft Entra ID, Okta, PingFederate)Export the updated metadata (XML)
In Fabriq, go to:
Organization Settings → Security → SSOReplace the existing metadata:
Paste the updated XML containing the new
<ds:X509Certificate>
Use the SSO test flow to validate the configuration
Runs a real SP-initiated SAML login
Does not require saving changes
Does not terminate your current session
Prevents accidental lockout
Save and apply the configuration
Key Takeaway
If you want reliable, zero-maintenance certificate rotation, switch to a metadata URL configuration. Static setups are more error-prone and require operational discipline during every certificate renewal.