Genesys Cloud - Main

Hi,

This very same certificate gets also added in Azure AD when 'Genesys Cloud for Azure' is added from Microsoft Entra Application gallery. Is it used by automatic user provisioning (Genesys SCIM integration)? In other words, do we need to upload the new certificate if we are using Genesys Cloud for Azure for automated user provisioning?

You said it's only impacting Single Logout, but wanted to double check this.

No, this cert isn't used by scim.  Scim utilizes a client credential grant oauth client, which then interfaces with our public API.  The only certificate involved is our certificate, which is provided via the AWS certificate authority, and managed by Genesys Cloud.

------------------------------
David Murray
Principal Product Manager
Genesys Cloud
------------------------------


Original Message:
Sent: 12-13-2023 03:39
From: Timo Välimäki
Subject: Genesys Cloud SSO certificate expiry notification 01/Jan/2024

Hi,

This very same certificate gets also added in Azure AD when 'Genesys Cloud for Azure' is added from Microsoft Entra Application gallery. Is it used by automatic user provisioning (Genesys SCIM integration)? In other words, do we need to upload the new certificate if we are using Genesys Cloud for Azure for automated user provisioning?

You said it's only impacting Single Logout, but wanted to double check this.

Hi David,

Why do I need to wait until January 1, 2024 to make this change? My Okta identity provider (does not allow multiple certifications) can remove the old Genesys Cloud SSO cert and add the new Genesys Cloud SSO cert within the Okta application today. 

David 

Also just to clarify, if you're using Azure vs ADFS for SSO, this certificate expiry shouldn't impact as you only export/import the Genesys certificate for ADFS, and not for Azure.  Is this correct?  Is this because the Genesys certificate within Azure for SSO is automatically renewed?

There would be no difference between Azure AD and ADFS in relation to this issue.  The key point to understand is whether your Identity Provider requires a certificate for Single Logout.  If they do not, you don't need to worry about this.  However, if they do, when you originally implemented SSO for Genesys Cloud you would have previously had to upload a certificate to the location specified by the Identity Provider and this is the cert that needs to be replaced.  

There would be no difference between Azure AD and ADFS in relation to this issue.  The key point to understand is whether your Identity Provider requires a certificate for Single Logout.  If they do not, you don't need to worry about this.  However, if they do, when you originally implemented SSO for Genesys Cloud you would have previously had to upload a certificate to the location specified by the Identity Provider and this is the cert that needs to be replaced.  

Also just to clarify, if you're using Azure vs ADFS for SSO, this certificate expiry shouldn't impact as you only export/import the Genesys certificate for ADFS, and not for Azure.  Is this correct?  Is this because the Genesys certificate within Azure for SSO is automatically renewed?

Dear David,

How can we check (in the Azure AD) if it using the certificate or not?

May be You can share some "print screens" (also that will describe how to install the new certificate)?

There would be no difference between Azure AD and ADFS in relation to this issue.  The key point to understand is whether your Identity Provider requires a certificate for Single Logout.  If they do not, you don't need to worry about this.  However, if they do, when you originally implemented SSO for Genesys Cloud you would have previously had to upload a certificate to the location specified by the Identity Provider and this is the cert that needs to be replaced.  

Also just to clarify, if you're using Azure vs ADFS for SSO, this certificate expiry shouldn't impact as you only export/import the Genesys certificate for ADFS, and not for Azure.  Is this correct?  Is this because the Genesys certificate within Azure for SSO is automatically renewed?

Dear David,

How can we check (in the Azure AD) if it using the certificate or not?

May be You can share some "print screens" (also that will describe how to install the new certificate)?

------------------------------
Best regards,

Yvgeni Liberman
ITNAV-Pro Ltd.
------------------------------


Original Message:
Sent: 12-22-2023 10:56
From: David Murray
Subject: Genesys Cloud SSO certificate expiry notification 01/Jan/2024

There would be no difference between Azure AD and ADFS in relation to this issue.  The key point to understand is whether your Identity Provider requires a certificate for Single Logout.  If they do not, you don't need to worry about this.  However, if they do, when you originally implemented SSO for Genesys Cloud you would have previously had to upload a certificate to the location specified by the Identity Provider and this is the cert that needs to be replaced.  

------------------------------
David Murray
Principal Product Manager
Genesys Cloud


Original Message:
Sent: 12-21-2023 21:12
From: Vaun McCarthy
Subject: Genesys Cloud SSO certificate expiry notification 01/Jan/2024

Also just to clarify, if you're using Azure vs ADFS for SSO, this certificate expiry shouldn't impact as you only export/import the Genesys certificate for ADFS, and not for Azure.  Is this correct?  Is this because the Genesys certificate within Azure for SSO is automatically renewed?

------------------------------
Vaun McCarthy

I checked in with our Cloud team to see if i had to upload a new cert on 1/1/2024 or not. They advised even though they have the Logout URL filled out on the Azure side, the Single Logout URI field on the SSO page of our Genesys Cloud site was blank. Therefor we have nothing to worry about....as we are not using the single logout feature.
E.g.

------------------------------
Simon Mckenzie
Farmers Mutual Group
------------------------------


Original Message:
Sent: 12-24-2023 02:33
From: Yvgeni Liberman
Subject: Genesys Cloud SSO certificate expiry notification 01/Jan/2024

Dear David,

How can we check (in the Azure AD) if it using the certificate or not?

May be You can share some "print screens" (also that will describe how to install the new certificate)?

------------------------------
Best regards,

Yvgeni Liberman
ITNAV-Pro Ltd.


Original Message:
Sent: 12-22-2023 10:56
From: David Murray
Subject: Genesys Cloud SSO certificate expiry notification 01/Jan/2024

There would be no difference between Azure AD and ADFS in relation to this issue.  The key point to understand is whether your Identity Provider requires a certificate for Single Logout.  If they do not, you don't need to worry about this.  However, if they do, when you originally implemented SSO for Genesys Cloud you would have previously had to upload a certificate to the location specified by the Identity Provider and this is the cert that needs to be replaced.  

------------------------------
David Murray
Principal Product Manager
Genesys Cloud


Original Message:
Sent: 12-21-2023 21:12
From: Vaun McCarthy
Subject: Genesys Cloud SSO certificate expiry notification 01/Jan/2024

Also just to clarify, if you're using Azure vs ADFS for SSO, this certificate expiry shouldn't impact as you only export/import the Genesys certificate for ADFS, and not for Azure.  Is this correct?  Is this because the Genesys certificate within Azure for SSO is automatically renewed?

------------------------------
Vaun McCarthy

Hi David

A comment here please if you could pass this on.  While hopefully most people can have this sorted, having a certificate with an expiry of Jan 1st where even some orgs have to renew on or after that is likely problematic for some.  A number of organisations around the world are actually closed on January 1st, meaning there's potentially no resource to actually do this or potentially no business test users available.

In that scenario the first opportunity to do it if multiple certs aren't supported is the very first day users would be trying to login - if you're saying they can't be swapped out ahead of time for some providers.

For future notifications of this expiry, can we please have all the information gathered this time around and added to that update at the time (next expiry looks to be in 2026).

Yes, I agree that this is not the best timing for this.  I will conduct a review of this cert change in January to determine how we can do this better next time around and to have more answers for the questions that are being asked on this thread.  I appreciate people posting comments regarding their experiences of this change and whether the cert is or is not required for their particular identity provider as, unfortunately, I don't have this information.  

Hi David

A comment here please if you could pass this on.  While hopefully most people can have this sorted, having a certificate with an expiry of Jan 1st where even some orgs have to renew on or after that is likely problematic for some.  A number of organisations around the world are actually closed on January 1st, meaning there's potentially no resource to actually do this or potentially no business test users available.

In that scenario the first opportunity to do it if multiple certs aren't supported is the very first day users would be trying to login - if you're saying they can't be swapped out ahead of time for some providers.

For future notifications of this expiry, can we please have all the information gathered this time around and added to that update at the time (next expiry looks to be in 2026).

Yes, I agree that this is not the best timing for this.  I will conduct a review of this cert change in January to determine how we can do this better next time around and to have more answers for the questions that are being asked on this thread.  I appreciate people posting comments regarding their experiences of this change and whether the cert is or is not required for their particular identity provider as, unfortunately, I don't have this information.  

Hi David

A comment here please if you could pass this on.  While hopefully most people can have this sorted, having a certificate with an expiry of Jan 1st where even some orgs have to renew on or after that is likely problematic for some.  A number of organisations around the world are actually closed on January 1st, meaning there's potentially no resource to actually do this or potentially no business test users available.

In that scenario the first opportunity to do it if multiple certs aren't supported is the very first day users would be trying to login - if you're saying they can't be swapped out ahead of time for some providers.

For future notifications of this expiry, can we please have all the information gathered this time around and added to that update at the time (next expiry looks to be in 2026).

Just adding to this, my assumption here is that this is January 1st in whatever region the org is in?  Can we also clarify the following:

1. I don't see any place in the enterprise app where you'd add this certificate other than the screenshot I included earlier
2. What is the behaviour of the 'logout' function if that single sign out field is left blank in Genesys Cloud?

I'm assuming this only applies to Okta Single Sign On, as that's where you download a certificate in the installation steps.
Looking through the Azure AD installation it seem you only download certificate from Azure and upload it to Genesys.

The Login URL and Logout URL uses the same domain on both AD and Okta integration, so if those certificates were affected it should affect login as well.
I looked at those certificates on different regions and the all seem to expire in September 2024.

Next time I hope we can get better information on exactly which services will be affected so this confusion doesn't happen.

Just adding to this, my assumption here is that this is January 1st in whatever region the org is in?  Can we also clarify the following:

1. I don't see any place in the enterprise app where you'd add this certificate other than the screenshot I included earlier
2. What is the behaviour of the 'logout' function if that single sign out field is left blank in Genesys Cloud?