Firstup is renewing the certificate used to sign SAML authentication requests sent from Firstup to customer identity providers (IdPs) on US1. If your IdP validates these requests, action by your IT team is required to avoid disruption to new Firstup initiated sign ins.

Who needs to take action?

You only need to take action if all of the following apply:

1. Your community is hosted on US1. I.e. your Creator Studio URL looks like https://studio.onfirstup.com/
2. Your organisation uses SAML single sign-on (SSO) for Firstup.
3. Your IdP is configured to validate signed SAML authentication requests from Firstup.
4. The host name in your Firstup entity ID begins with advocate.—for example, https://advocate.socialchorus.com/community/community/saml/metadata—or you use a custom URL that redirects to an advocate. URL, such as https://nextup.firstup.com/saml/metadata.

No action is required if:

• Your community is hosted on EU or US2. I.e. your Creator Studio URL looks like https://studio.onfirstup.eu/ or https://studio.us2.onfirstup.com/ 
• Your organisation does not use SSO for the member experience (desktop and mobile, microapps, Teams, etc.).
• Your IdP does not validate signed SAML requests from Firstup.
• Your Firstup entity ID begins with auth..

What is changing?

Firstup will replace the public certificate used to sign SAML authentication requests. When the new certificate is deployed, the previous certificate will no longer validate new Firstup-initiated sign-in requests.

Save the following cert as a plain-text file with a .pem extension:

-----BEGIN CERTIFICATE-----
MIIESTCCAzGgAwIBAgIUbi7CYwOU2t2+p3c3H/KLZXmcwogwDQYJKoZIhvcNAQEL
BQAwgbMxCzAJBgNVBAYTAlVTMRMwEQYDVQQIDApDYWxpZm9ybmlhMRYwFAYDVQQH
DA1TYW4gRnJhbmNpc2NvMRUwEwYDVQQKDAxTb2NpYWxDaG9ydXMxFDASBgNVBAsM
C0VuZ2luZWVyaW5nMSIwIAYDVQQDDBlhZHZvY2F0ZS5zb2NpYWxjaG9ydXMuY29t
MSYwJAYJKoZIhvcNAQkBFhdkZXZvcHNAc29jaWFsY2hvcnVzLmNvbTAeFw0yNjA5
MjgxNTQyNTZaFw0zNjA5MjUxNTQyNTZaMIGzMQswCQYDVQQGEwJVUzETMBEGA1UE
CAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzEVMBMGA1UECgwM
U29jaWFsQ2hvcnVzMRQwEgYDVQQLDAtFbmdpbmVlcmluZzEiMCAGA1UEAwwZYWR2
b2NhdGUuc29jaWFsY2hvcnVzLmNvbTEmMCQGCSqGSIb3DQEJARYXZGV2b3BzQHNv
Y2lhbGNob3J1cy5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDp
NE278snPyLMGE8HMGlqH/B17I+uQ4xdcyOFh6CBFyLTXfd9IMNmuDHfCL9+i8yte
lyzFf0/po9+o4DLtp0l+3ScIP28Q8zQx6ykbOUB1Wugzfr3W755nOHsi7a9nX8Hq
BNGUWuEzHo/f/xFMNsCPDNIll0JMaX/jyemhPVA4ju6UR+L1sHXbM1n+GPy6WCO4
rWNalCgzJUoiUoJDdTyjHIHol9R2z3ivwIcEcCTQYLHfcSO8Uisg9ZljVMfhWVdr
yH6k1Z7D/LTnWUE2fTG56Ud8WCCnGu872fvG9wsmLo+O8whPVK/VmD9GKjofwtm4
q2m7H7lw2dPlVmd2+84zAgMBAAGjUzBRMB0GA1UdDgQWBBRMKU3OaV8FNOii7jn5
cGTooMuBKzAfBgNVHSMEGDAWgBRMKU3OaV8FNOii7jn5cGTooMuBKzAPBgNVHRMB
Af8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQALKZNn9AF9C8azOSd7Ru3DwOrR
5zIkIUFP35P5w5OI7D0X4irumB6Bwh8EqGmT/lP2y7hKguifc3YmCI4RZS9BrvTc
pPpf/MbNwvmmnqRpEOPXB2u4qdyfVMr8R+9Ml2nZimGIEXT2IdyY9SvvYSGaPx9j
ZAV0s4jBPvOtUprP0CZ13mEQ+om/AEdwbQd8b6ODitCcU5TY/UZGRN1TY7XYd9ng
nGg9qx4ECGYWuTkACBwVrc48NSwxUkE7R9XCnkhcA3g/IUl/7K942/1eG38DV7R8
hIM2TXhMcdat7dAjbvtKZzOhxpErs7BXr/7tku4FchcjUAryrdlUhzkA3Ip0
-----END CERTIFICATE-----

Use the PEM file that you have created as the signature certificate source for your IdP configuration.

The replacement certificate will also be available in your Firstup SAML metadata after Firstup completes the maintenance window. Firstup will confirm completion on the Status Page.

What to do on 13 October 2026

Firstup will replace the certificate used to sign SAML authentication requests during a maintenance window on 13 October 2026. Firstup will confirm when the update is complete on the Status Page.

Until completion is confirmed:

• If your IdP supports only one trusted request-signing certificate, keep signed-request validation disabled if you disabled it as part of your change plan.
• If your IdP supports multiple trusted request-signing certificates and you added the replacement certificate in advance, no further configuration change is required until after maintenance completes.

What to do after maintenance is complete

After Firstup confirms completion on the Firstup Status Page:

1. If you temporarily disabled signed request validation because your IdP supports only one certificate, add the replacement PEM file to your Firstup SAML application in the IdP, then re-enable validation.
2. If you added the replacement PEM file in advance because your IdP supports more than one certificate, no certificate change is needed at this point.
3. Test a Firstup initiated sign in.
4. If the test is unsuccessful, temporarily disable signed request validation again and contact Firstup Support.

Alternative way to retrieve the replacement certificate

The PEM file supplied by Firstup is the recommended source. If needed, you can also retrieve the certificate from your Firstup SAML metadata after the maintenance window:

After Firstup confirms completion on the Status Page, retrieve the new certificate from your Firstup SAML metadata:

1. Sign in to Creator Studio.
2. Select your community name in the lower-left corner and choose Go to [Community Name].
   

3. In the new page URL, remove /welcome (if present), and add /saml/metadata to the end of the URL.

   For example: https://advocate.socialchorus.com/community/community/saml/metadata

4. Copy or download the X.509 certificate from the XML metadata.
   Note: If the metadata page does not load, this indicates that your organisation does not use SSO for the member experience and is not in scope of this change.
5. Add the new certificate to the Firstup SAML application in your IdP.
6. Enable signed-request validation in your IdP.
7. Test a Firstup-initiated sign-in.
8. If Firstup-initiated sign-in is unsuccessful, disable signed-request validation again and contact Firstup Support for further assistance.

How to identify whether this certificate update is causing an SSO issue

This certificate change may be the cause of failures to sign in via SSO if all of the following are true:

• The issue began after Firstup confirmed completion of the 13 October maintenance.
• Your community is hosted on US1 and uses SAML SSO.
• Your Firstup entity ID begins with advocate., or your custom URL redirects to an advocate. URL.
• Your IdP validates signed SAML authentication requests from Firstup.
• A Firstup-initiated sign-in fails—for example, when a user starts from Firstup—while IdP-initiated access through the Firstup application tile in your IdP portal still works.

Your IdP may show a signature-validation or certificate-related error, but the exact message differs by provider and configuration.

If these conditions apply, check that the replacement certificate has been added to your Firstup SAML application and that signed-request validation is enabled. If your IdP supports only one certificate and you have not yet completed the update, temporarily disable signed-request validation, add the replacement certificate, re-enable validation, and test again.

If the issue began before the maintenance, investigate this as a broader SSO issue rather than assuming it is caused by the certificate update.

How to check and add multiple verification certificates

Microsoft Entra supports multiple verification certificates, you can follow the information below if you use Microsoft Entra. Unfortunately Okta does not currently support multiple verification certificates and you should follow the instructions in the next section to check and temporarily disable request verification.

Microsoft Entra ID

1. Sign in to the Microsoft Entra admin center.
2. Go to Entra ID > Enterprise applications > All applications.
3. Select your Firstup SAML application.
4. Select Single sign-on.
5. Under SAML Certificates, find Verification certificates.
6. Select Edit and check whether Require verification certificates is enabled.

If this setting is not enabled, your organisation is not in scope and no action is required.

If the setting is enabled and you have not already added the replacement certificate, add it alongside any existing certificates. Then test a Firstup-initiated sign-in after Firstup confirms completion of the maintenance.

You can find more information about where to configure this in Microsoft Entra: Enforce signed SAML authentication requests.

How to check and temporarily disable signed-request validation

Okta

1. Sign in to the Okta Admin Console.
2. Go to Applications > Applications.
3. Select your Firstup SAML application.
4. Select the Sign On tab and edit the SAML settings.
5. Under Advanced Settings, check whether Signed Requests is selected.

If Signed Requests is selected, your organisation is in scope. If you have not already done so, clear this setting before the maintenance begins. After Firstup confirms completion, add the replacement certificate in the Signature Certificate field, re-enable Signed Requests, and test a Firstup-initiated sign-in.

If Signed Requests is not selected, Okta is not validating Firstup's SAML request signature and no action is required.

For field definitions, see Okta's SAML application settings reference.

Recommended day-of checklist

• Monitor the Firstup Status Page for confirmation that maintenance is complete.
• Confirm whether signed-request validation is currently disabled for any affected Firstup SAML applications.
• After completion, install the replacement PEM certificate where required and re-enable validation.
• Test Firstup-initiated sign-in.
• Confirm the IdP-initiated fallback remains available.
• Notify your IT and service desk teams when validation and testing are complete.