---
title: "Are CA-signed certificates necessary for SAML security?"
description: "SAML certificates don’t work the same way as web SSL certificates. Here’s why self-signed certificates are the secure, standard choice for SAML, and when a CA-signed certificate might still make sense."
url: https://workos.com/blog/ca-signed-certificates-saml
published: "Sep 18, 2025"
---

# Are CA-signed certificates necessary for SAML security?

> **TL;DR** SAML doesn’t depend on the traditional CA trust model. Self-signed certificates are normal and secure, unless your organization has a specific compliance requirement.

When setting up a SAML integration, one of the most common questions we hear is: *“Do I need a trusted CA-signed certificate for my SAML signatures?”*

It’s a great question, because digital certificates and certificate authorities (CAs) are usually associated with secure communication on the web (think HTTPS). But in the world of SAML, the answer is a little different.

## **What’s a CA-signed certificate?**

A CA-signed certificate is a digital certificate that’s been issued and validated by a Certificate Authority (CA); a trusted third party like DigiCert, GlobalSign, or Let’s Encrypt.

On the web, CAs play a critical role: your browser trusts them, which is why you can be confident that https://example.com really is the site it claims to be.

But in SAML, you don’t need that global trust model.

## **What role do certificates play in SAML?**

Certificates in SAML are not about proving identity to the outside world (like with HTTPS). Instead, they are used for **cryptographic signing and verification** between the [Identity Provider (IdP)](https://workos.com/blog/what-is-an-identity-provider) and the [Service Provider (SP)](https://workos.com/blog/idp-vs-sp-what-is-a-service-provider-and-an-identity-provider#what-is-a-service-provider).

- The IdP signs SAML assertions with its private key.
- The SP validates those assertions using the IdP’s public certificate.

This ensures two things:

1. The assertion really came from the IdP.
2. The contents weren’t altered in transit.

That’s all that’s needed for SAML to work securely.

## **Why a CA-signed certificate usually isn’t needed**

Unlike HTTPS/TLS, where your browser needs to trust a certificate chain anchored by a known CA, SAML doesn’t depend on that global trust model. Instead, it uses **explicit trust** established directly between the two parties:

- The IdP generates its certificate and shares the public key (part of the [certificate](https://workos.com/blog/x509-certificate)) with the SP, often through a separate channel like email or a [configuration portal](https://workos.com/blog/x509-certificate#how-to-get-an-x-509-certificate-the-easy-way).
- The SP installs and trusts only that certificate.
- From then on, any assertion signed with the corresponding private key will be accepted.

Because trust is established in this one-to-one way, there’s no requirement for a third-party CA. That’s why **self-signed certificates are perfectly acceptable**, and in fact, what most organizations use for SAML federation.

## **When might a CA-signed certificate be useful?**

There are a few edge cases where a CA-signed certificate can still be helpful:

- **Enterprise policy requirements**: Some organizations have internal security or compliance policies that mandate CA-signed certificates for all cryptographic material, even when not technically required.
- **Certificate lifecycle management**: Using a CA may simplify certificate rotation, renewal, or revocation if the company already has established tooling around PKI.
- **Audit and compliance assurance**: In regulated industries, auditors may feel more comfortable seeing CA-backed certificates even if they don’t change the security posture in SAML.

## **The bottom line**

For most SAML use cases, **a self-signed certificate provides the same security guarantees as a CA-signed one**. The key factor is whether both the IdP and SP are configured to trust the same certificate.

- **Self-signed certificates are secure and standard** in SAML.
- **CA-signed certificates are optional** and usually only required by organizational policy, not by the SAML specification itself.

If you’re setting up a SAML connection and wondering whether you need to pay for or request a CA-signed certificate, the answer is almost always: *“No, you’re fine with a self-signed certificate.”*