Renew IdP certificates

Identity provider (IdP) certificates are automatically created when you install Splunk SOAR (On-premises) and have an an expiry date of two years from the time they were created. To renew Splunk SOAR (On-premises) IdP certificates, follow these steps:

  1. Connect to your Splunk SOAR (On-premises) deployment using SSH.
  2. Navigate to the /<PHANTOM_HOME>/keystore directory and create a folder and name it cert.save.
  3. Copy all existing certificates listed in the /<PHANTOM_HOME>/keystore directory to the cert.save folder.
  4. Delete all pem or der files in the /<PHANTOM_HOME>/keystore directory except private_key.pem. private_key.pem is used to decrypt the password and will not be updated.
  5. Change directory to /<PHANTOM_HOME>/bin.
  6. Update the current certificate files by running the following command: 
    phenv python /opt/phantom/bin/initialize.py --set-auth-keys --force

The new IdP certificates are generated under the /<PHANTOM_HOME>/keystore directory and are valid for 2 years. If necessary, you can then copy the relevant public signing key to your IdP.

  • If you use SAML, copy public_sig_saml2.pem to your IdP.
  • If you use OIDC, copy public_sig_oidc.der to your IdP.