Self-service certificate and secret management for single sign-on

Managing single sign-on credentials is now self-service. For Microsoft Entra, the gateway generates the sign-in certificate itself — create it, download the .cer file, and upload it in Azure; the private key never leaves the gateway. Certificates can be rolled over without an outage: prepare a replacement while the current one keeps signing, upload it at the identity provider, then activate it in one click, with the previous certificate visible until you remove it.

Each provider card counts down the days until its certificate expires, the connection test flags one that is about to lapse, and an e-mail goes out a month before sign-in would break. Every stored secret shows when it was last changed, and one pointing at a missing environment variable or file is shown as unreadable rather than healthy.

No action required.