Netskope Global Technical Success (GTS)
Replacing Expiring Entra ID SAML Certificates for Netskope Services
Netskope Cloud Version - 126
Objective
The purpose of this article is to explain how to replace the SAML Entra ID certificate used for Netskope SSO Tenant Access, Forward Proxy, or Reverse Proxy. This article explains the procedure for replacing the Entra ID certificate used for SAML authentication with Netskope for Tenant Access, Forward Proxy, or Reverse Proxy.
Prerequisite
Netskope tenant access and Entra ID access are required.
Context
When creating an enterprise application in Entra ID for Netskope Administration Console (SSO Tenant Access), or Netskope User Authentication (Forward Proxy or Reverse Proxy), Entra ID generates a SAML Certificate with an expiration date. When the expiration date is reached, you must renew the Entra ID SAML certificate, activate, and re-submit the certificate onto Netskope.
| ℹ️ Expired certificates will trigger a warning similar to the one below in both "SAML - Forward Proxy" and "SAML - Reverse Proxy" |
Configuration
Step # 1 - Generate a new Entra ID Certificate (when expired or soon to be expired).
Path: Entra ID UI >>> Enterprise Applications >>> Select the Netskope Application with expired SAML certificate >>> Single sign-on
- Click on “Edit”, select “New Certificate”, then press “Save”
| ℹ️ When new certificate is saved, it will inactive state. |
Step #2 - Download the New certificate
- Click on the new inactive certificate settings, then press “Base64 certificate download”
Step #3 - Make the New certificate active
- Click on “Make Certificate active”
Step #4 - Replace the Entra ID SAML certificate on Netskope Forward Proxy
Path: Netskope Tenant UI >>> Security Cloud Platform >>> Forward Proxy >>> SAML
- Click on Application’s name
- Remove the old certificate and submit the new certificate, then press “Save”
Validation
After the Entra ID SAML certificate is replaced, please ensure that everything is working as expected by performing the below test.
*** This test will only work if you use a valid user assigned to the enterprise application ***
| ℹ️ The above process can be extended to any other pages where 3rd party SAML certificate is needed to be submitted onto Netskope, such as SSO page, and SAML Reverse Proxy. |
Terms and Conditions
- All documented information undergoes testing and verification to ensure accuracy.
- In the future, it is possible that the application's functionality may be altered by the vendor. If any such changes are brought to our attention, we will promptly update the documentation to reflect them.
Notes
- This article is authored by Netskope Global Technical Success (GTS).
- For any further inquiries related to this article, please contact Netskope GTS by submitting a support case with 'Case Type – How To Questions'.
