How do I update an expiring SSO certificate for my company in Procore?

Single Sign-On (SSO) requires an active X.509 certificate to allow your users to log in to Procore securely. Because these certificates expire periodically, you must update the certificate in Procore before it lapses to prevent user login disruptions. Procore does not send expiration alerts, though Identity Providers (IdPs) typically send a renewal reminder.

To update an expiring SSO certificate, obtain the new certificate text from your Identity Provider (IdP) and update your company settings in Procore.

1. Generate a new X.509 certificate within your IdP. For specific steps, refer to your IdP's documentation.

2. Save the certificate file to your computer as a text file.

3. Open the file and copy only the certificate text between the start and end markers.

    Warning

   Copy only the text between the markers. Do not include the HTML start and end tags (if using Microsoft Entra ID) or the --- BEGIN CERTIFICATE --- and --- END CERTIFICATE --- lines if using another IdP.

4. Log in to the Procore web application.

5. Navigate to the Company level Admin Tool.

6. Under Company Settings, click Single Sign-On Configuration.

7. Clear the Single Sign-On x509 Certificate field.

8. Paste the new certificate into the Single Sign-On x509 Certificate field.

9. Optional: To safely test the certificate without risking a lockout, change the login mode to Allow Password Login instead of Service Provider Forward before saving.
   

   Note

   This allows users to sign in with their Procore credentials if SSO fails. After you verify that SSO works, select Service Provider Forward and click Save to restore standard SSO enforcement.

10. Click Save.