Marketing Cloud Single Sign-On Certificate Update

What is happening?
As of 2025, the only type of certificate that Marketing Cloud Engagement SSO supports is a Self-Signed Certificate.   If you cannot upload a Self-Signed certificate, you will want to either: 

What do you need to do?

1. Modify your IdP policies to allow for Self-Signed Certificates to be utilized.
2. Disabled signature validation on AuthNRequests / SLO and/or Encryption of assertions

How can you update your certificate?
Administrators need to follow the steps below to update their SSO certificate. Log in as Marketing Cloud administrator to the top level Marketing Cloud account (not at the child BU level) and follow the steps below:

1. Under Setup, in Security Settings, select Single Sign-On Settings and opt in to acquire the latest 2025 certificate that is valid until February 5th 2025. Click Save explicitly.
2. Download the SP Metadata and copy the certificate.
3. Update the Identity Provider (IdP) with the new certificate.

Where can you get additional information?
More information regarding the procedure to update the SSO certificate is available in the Update Your Marketing Cloud SSO Certificate document.