Certificate Renewal Procedure

Overview

Two categories of certificates require manual tracking and renewal:

1. OneLogin SAML signing certs — used by Cloudflare Access to validate SSO. These do NOT auto-renew. Expiry causes immediate SSO lockout for all apps that trust that cert. This already happened in May 2025 (Zendesk and KnowBe4 locked out).

2. GlobalProtect TLS wildcard cert (*.ciriusgroup.com) — the TLS certificate on the GlobalProtect VPN gateway. Used by CEO/CTO for remote access.

Both are monitored by cert_expiry_agent in bedrock-soc/agents/. Alert thresholds:

• <90 days: Medium
• <60 days: High
• <30 days: Critical
• Expired: Critical + immediate_action_required = true

Do not wait for an alert — renew proactively when you see a High finding. A 30-day window is too short if you need to coordinate with a vendor or test the SP metadata update.

---

OneLogin SAML Certificates

Apps Monitored

App	OneLogin Metadata URL
Keeper	https://app.onelogin.com/saml/metadata/c12bdc0f-2856-42b3-8987-f599f8bbfaff
Zendesk	https://app.onelogin.com/saml/metadata/57405316-52f7-4296-ae9c-80d4bc843e06
Zendesk (secondary)	https://app.onelogin.com/saml/metadata/b03c44e0-3b73-4e2a-8a12-db93f07a3c4e
KnowBe4	https://app.onelogin.com/saml/metadata/a3522f7e-726f-4483-9ccf-58fe81bb1bbd

Each app has its own cert. Renewing one does not affect the others.

What Happens When a SAML Cert Expires

OneLogin signs SAML assertions with its IdP cert. The service provider (Keeper, Zendesk, KnowBe4) validates the signature against the cert it has stored from when SSO was configured. When OneLogin rotates or regenerates the cert, the SP's stored copy no longer matches and SSO authentication fails for all users. This is not gradual — it is immediate total lockout for that app.

How to Renew a OneLogin SAML Cert

1. Log into OneLogin Admin at https://ciriusgroup.onelogin.com/admin
2. Navigate to Applications → Applications
3. Select the app (e.g., Keeper)
4. Click the SSO tab
5. Under "X.509 Certificate", click More Options → Rekey Certificate
   • This generates a new cert and invalidates the old one
   • OneLogin immediately begins signing assertions with the new cert
6. Click Save on the application

Immediately after rekeying — update the SP metadata:

The service provider still has the old cert. You must upload the new cert (or updated metadata XML) to each app's SSO/SAML settings before the rekey takes effect. If you save without updating the SP, SSO will break immediately.

Updating SP Metadata After Rekey

Keeper

1. Log into Keeper Admin Console → Admin → SSO Cloud
2. Find the Cirius Group enterprise configuration
3. Download the new metadata from OneLogin: Applications → Keeper → More Actions → SAML Metadata
4. In Keeper Admin, upload the new metadata XML or manually paste the new IdP cert
5. Test with a non-admin user before confirming completion

Zendesk

1. Log into Zendesk Admin Center → Security → Single sign-on → SAML
2. Download the new metadata from OneLogin for the Zendesk app
3. Update "IDP certificate fingerprint" or upload the new cert PEM
4. There are two Zendesk entries — update both (primary and secondary)
5. Test SSO login before confirming

KnowBe4

1. Log into KnowBe4 Admin → Account Settings → User Provisioning → SAML
2. Download the new OneLogin metadata XML for the KnowBe4 app
3. Upload the new metadata or paste the updated cert into the IdP certificate field
4. Test SSO login before confirming

Safe Rotation Approach (Zero Downtime)

Some apps support staging a new cert before the old one expires — the SP accepts both certs during a transition window. Check if the app supports this before a hard cutover.

The safest approach:

1. Schedule renewal during off-hours (low user activity)
2. Rekey in OneLogin
3. Immediately update the SP metadata
4. Test SSO login with a non-admin test account
5. If SSO fails, OneLogin may let you revert — check before saving; once saved, the old cert is gone

Checking Cert Expiry Manually

# Fetch the OneLogin metadata XML and look at the certificate
curl -s "https://app.onelogin.com/saml/metadata/c12bdc0f-2856-42b3-8987-f599f8bbfaff" \
  | grep -o '<ds:X509Certificate>[^<]*' | sed 's/<ds:X509Certificate>//' \
  | base64 -d | openssl x509 -inform DER -noout -dates

Or just look at the cert_expiry_agent finding in SecOps — it reports exact expiry dates for all four apps every 4 hours.

---

GlobalProtect Wildcard Certificate

Certificate Details

• Common Name: *.ciriusgroup.com
• Cert name in Palo Alto: CiriusGroupWildcard2025
• Used by: GlobalProtect VPN gateway (CEO/CTO remote access)
• Service profile: ssl-tls-service-profile named GlobalProtect
• Managed in: Panorama → Device → Certificates

The wildcard cert covers all *.ciriusgroup.com subdomains. If renewed as a new wildcard, it also covers any other subdomains using this cert (check before replacing).

Where to Get a New Wildcard Cert

The *.ciriusgroup.com wildcard cert is a purchased TLS certificate (not self-signed). Renewal options:

• Let's Encrypt: Free, 90-day, automated via ACME. Requires DNS challenge (add TXT record to ciriusgroup.com zone). Works but requires scripting the renewal.
• DigiCert / Sectigo / Comodo: Purchase a new 1-year or 2-year cert. Download as PEM + private key + certificate chain.
• Current provider: Check the existing cert's issuer via:

  echo | openssl s_client -connect <GP-gateway-host>:443 -servername <GP-gateway-host> 2>/dev/null \
    | openssl x509 -noout -issuer -dates

For any method, you need: the new cert (PEM), the private key (PEM), and the CA chain.

How to Import the New Cert to Panorama

1. Log into Panorama at its management IP (see aws-network-topology.md for IP)
2. Navigate to Device → Certificates
3. Click Import
4. Enter the name: CiriusGroupWildcard2025 (or increment year: CiriusGroupWildcard2026)
5. Upload the certificate file (PEM)
6. Upload the private key (passphrase-protected or plaintext PEM)
7. Click OK

Update the SSL/TLS Service Profile

1. Navigate to Device → Certificate Management → SSL/TLS Service Profile
2. Click on the profile named GlobalProtect
3. In the Certificate field, select the new cert name
4. Click OK

Commit and Push

1. Panorama → Commit → Commit to Panorama — saves the change in Panorama
2. Then Commit → Push to Devices — selects all managed firewalls and pushes
3. Verify: after push completes, attempt a GlobalProtect connection from an external machine to confirm TLS is valid with the new cert

Testing After Renewal

# Verify the new cert is live on the GP gateway
echo | openssl s_client -connect <GP-gateway-host>:443 -servername <GP-gateway-host> 2>/dev/null \
  | openssl x509 -noout -subject -dates

The output should show the new notAfter date.

---

Monitoring and Alerting

cert_expiry_agent runs every 4 hours as part of the bedrock-soc agent orchestration. It checks:

• All four OneLogin SAML metadata URLs directly (no auth required)
• GlobalProtect TLS cert via TLS handshake to GATEWAY_GP_HOST (set in Container App env vars)

Findings appear in SecOps under the cert_expiry agent. A Medium finding at 90 days gives you 30 days of comfortable lead time before it escalates to High.

If the agent fails to reach a metadata URL (network error, URL changed), it generates a High finding so the manual fallback is triggered.

---

Incident History

Date	Cert	What Happened
May 2025	OneLogin SAML — Zendesk, KnowBe4	Cert expired without alert. Zendesk and KnowBe4 SSO locked out. Manual rekey + SP update required to restore access.

This incident is why cert_expiry_agent exists and why the 90-day Medium threshold was chosen — it gives two full warning cycles before Critical.

---

Document History

Date	Change	Author
May 2026	Initial draft — OneLogin SAML renewal steps for Keeper/Zendesk/KnowBe4, GlobalProtect wildcard cert renewal via Panorama, monitoring description.	Rory