How to Configure Google Workspace SAML Certificate Rotation

The Cryptographic Expiration Problem

When you configure Google Workspace to act as a Single Sign-On (SSO) Identity Provider (IdP) for a third-party application like Salesforce or Slack, the security of that authentication relies entirely on Public Key Infrastructure (PKI). When a user logs into Google, Google generates a SAML assertion (a small XML document saying “Yes, John Doe authenticated successfully”) and cryptographically signs it using an X.509 private key.

Slack receives this XML document and verifies the signature using Google’s public key (the certificate). If the signature matches, Slack lets the user in. However, these X.509 certificates do not last forever. By industry standard, Google Workspace SAML certificates expire exactly 5 years from the date they are generated.

If you fail to rotate the certificate before it expires, the cryptographic trust chain breaks instantly. When John Doe logs in on Monday morning, Slack will reject the SAML assertion because the signature is invalid. Your entire company will be locked out of every single third-party application simultaneously. You must proactively orchestrate a certificate rotation.

Step 1: Generating the New Certificate

You cannot simply click “Renew.” You must generate a completely new cryptographic key pair within the Google Workspace Admin Console.

1. Log into the Google Workspace Admin Console as a Super Administrator.
2. Navigate to Security > Authentication > SSO with SAML applications.
3. Scroll down to the Certificates section. Here you will see your current Active certificate and its expiration date.
4. Click Add Certificate.
5. Google will instantly generate a new 2048-bit RSA key pair. This new certificate is now listed, but it is entirely dormant. Google is not using it yet.
6. Click the Download button next to the new certificate to save the .pem or .cer file to your hard drive.

Step 2: Updating the Service Providers (The Danger Zone)

This is the most critical phase. You now have two certificates in Google: the old one (which is currently active and signing everything) and the new one (which is dormant).

You must now log into the administrative console of every single third-party application (Salesforce, Slack, Zoom, AWS, etc.) and upload the new public key.

For example, in Slack:

1. Log into the Slack Admin workspace.
2. Navigate to Settings & Permissions > Authentication > SAML Authentication.
3. Locate the Public Certificate field.
4. Some Service Providers (like AWS) allow you to have two active IdP certificates simultaneously to ensure a smooth transition. If so, upload the new one alongside the old one. If the Service Provider only allows one certificate at a time (like older versions of Slack), you must prepare to execute Step 3 immediately after uploading, as authentication will break for a few seconds.

Step 3: Flipping the Switch in Google Workspace

Once all your third-party applications possess the new public key, you must instruct Google Workspace to stop using the old private key and start signing assertions with the new private key.

1. Return to the Google Workspace Admin Console (Security > Authentication > SSO with SAML applications).
2. Click on the SAML Applications list.
3. You must update this on a per-application basis to minimize risk. Click on “Slack.”
4. In the Service Provider Details section, locate the IdP Certificate dropdown.
5. Change the dropdown from the old, expiring certificate to the brand new certificate you generated in Step 1.
6. Click Save.

Step 4: The Verification

The moment you click Save, Google immediately begins signing all new SAML assertions for Slack using the new private key. Because you already uploaded the corresponding public key to Slack in Step 2, the cryptographic handshake will succeed.

You should immediately open an Incognito window and attempt to log into Slack using SSO to verify the flow is working.

Once you have migrated all your SAML applications (AWS, Zoom, Salesforce) to the new certificate dropdown, you can safely return to the main Certificates page in Google Workspace and delete the old, expiring certificate, successfully completing the 5-year rotation cycle with zero downtime.