> For the complete documentation index, see [llms.txt](https://docs.boston.gov/digital/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.boston.gov/digital/guides/amazon-web-services/webapps/access-boston/updating-saml-certificates.md).

# Updating SAML Certificates

SSO/SAML Certificate expire after a couple of years. Below describes the new process for updating the cert used by the Web app.

The certificate is used when the web app attempts to create a connection (login/forgot) to the Access-Boston via SAML. This takes place in the function below:

```typescript
samlAuth = await makeSamlAuth(
{
  metadataPath: './saml-metadata.xml', // Enter new CERTIFICATE in this file
  serviceProviderCertPath: './service-provider.crt',
  serviceProviderKeyPath: './service-provider.key',
},
```

The files that need to be updated are stored in AWS S3 buckets at:

TEST

* cob-digital-apps-staging-config/access-boston/test/saml-metadata.xml
* cob-digital-apps-staging-config/access-boston/test/saml-forgot-metadata.xml

DEV

* cob-digital-apps-staging-config/access-boston/dev/saml-metadata.xml
* cob-digital-apps-staging-config/access-boston/dev/saml-forgot-metadata.xml

PROD

* cob-digital-apps-prod-config/access-boston/test/saml-metadata.xml
* cob-digital-apps-prod-config/access-boston/test/saml-forgot-metadata.xml

Copy the Certificate RSA Key and paste it into the `<ds:X509Certificate>` node in the `saml-metadata.xml` and `saml-forgot-metadata.xml` files.

After this is done restart the AWS ECS container task for the `Access-Boston` service (`PROD, TEST or DEV`). Immediately after the SECURITY Team should swap out the certificate used by that service. Making this change will lead to a few minutes of down time for the service so it should be done with coordination with the Security team and logged in a `Change Order` request.&#x20;