Honeycomb periodically updates the Service Provider certificates used for SAML Single Sign-On (SSO) authentication.
When a new certificate is available, Team Owners will see a notification in their team’s SAML settings and should update their Identity Provider configuration to use the new certificate.
Note
Honeycomb continues to honor older certificates even after newer ones are available.
However, we recommend updating to the latest certificate for improved security and to ensure continued support.
Before you begin
To successfully complete this guide, you should have:
Team Owner permissions in Honeycomb
Administrative access to your SAML Identity Provider (IdP) (such as Okta or Microsoft Entra ID)
A SAML Identity Provider that is configured to encrypt assertions
An active SAML SSO configuration for your Team
Copy the new certificate
In Honeycomb, navigate to Account > Team Settings.
Select the Team Details view.
Locate the Single Sign-On section.
Select Change next to your SAML configuration.
In the SAML configuration form, locate the Service Provider Certificate field.
This field displays the latest certificate that your IdP needs to use.
Select the copy button next to the Service Provider Certificate.
Save the copied Certificate to a local file. Most Identity Providers require it in .pem format.
Update your Identity Provider
Now update your Identity Provider configuration with the new Service Provider Certificate.
The specific steps vary depending on your Identity Provider.
Okta
To update the certificate in Okta:
Open a new browser tab and navigate to your Okta admin console.
Go to Applications > Applications.
Select your Honeycomb application from the list.
Select the General tab.
In the SAML Settings section, select Edit.
Select Next to advance past the General Settings.
Select Show Advanced Settings.
Ensure that the “Assertion Encryption” field is set to “Encrypted”. If it is set to “Unencrypted”, you do not need to do anything.
In the Encryption Certificate field, upload the certificate file you saved from Honeycomb.
Select Next, then Finish.
Other SAML providers
If you use a different SAML Identity Provider, locate the equivalent certificate or encryption certificate settings in your provider’s administration interface.
Upload or paste the new Service Provider Certificate that you copied from Honeycomb.
Complete the certificate update
After updating your Identity Provider with the new certificate, complete the update process in Honeycomb:
Return to the browser tab with your Honeycomb SAML configuration form.
Select Update SAML Configuration.
Complete the authentication flow with your Identity Provider.
If successful, you return to your team’s Home page in Honeycomb.
The warning notification in your team’s SAML settings should no longer appear.
For more information about SAML configuration, see:
