Rotate the service-provider certificates of 31 depots that expire in February

Project: Engineering
Type: Task
Status: Done Done
Priority: High
Reporter: Marek Nowak <marek.nowak@acme-hq.example>
Assignee: Marek Nowak <marek.nowak@acme-hq.example>
Labels: single-sign-oncertificates
Components: identity-service
Fix versions: identity-service 2026.02.27
Sprint: Sprint 36
Created: 6 Jan 2026, 09:10 UTC
Updated: 27 Feb 2026, 10:15 UTC
Resolved: 27 Feb 2026, 10:15 UTC

Description

Each depot on single sign-on has its own service-provider certificate on our side (DepotSamlConfig). The 31 made in early 2024 expire between 16 February and 27 February.

Per depot, 30 days before expiry: php artisan saml:rotate-sp {client} {depot} publishes both certificates; support tells the customer's IT the same day; they update the depot's app in Entra ID within the 30 days; the old certificate drops out on expiry. Process in Confluence OPS › SAML certificates: expiry checks.

Comments (2)

Marek Nowak · 19 Jan 2026, 15:30 UTC

All 31 rotated, both certificates published. Support emailed the IT contacts at Parcelwise (18 hubs), Almwerk (9 sites) and two smaller clients.

Marek Nowak · 27 Feb 2026, 10:15 UTC

Every depot's IdP now trusts the new certificate; the old ones expired without a failed sign-in. Closing.