---
title: Encrypting SAML assertions
slug: access-guide/encrypting-saml-assertions
docTags: 
createdAt: 2026-10-09T06:41:05.865Z
---

Enabling encryption of SAML assertions adds another layer of security. Enable this feature in a mobile app single sign-on setup if the SP supports SAML assertion decryption. The SAML assertions are encrypted such that the assertions can be decrypted only with the private keys held by the service provider.

- Encryption of SAML assertions is disabled by default.
- Responses can be signed while carrying a signed encrypted Assertion, but the Response itself is not encrypted.
- Do not use the signing certificate for encrypting SAML assertions and vice-versa.
- The following service providers (SP) support encryption of SAML assertions:
  - Salesforce
  - Custom SAML Service Provider
  - Custom WS-Federation Service Provider
- A default certificate for encryption is automatically available in your Ivanti Access tenant.
- Enabling SAML assertion encryption, enables additional options for Native Mobile Application Single Sign-On (SSO). These options allow you select the data encryption algorithm and the key transport algorithm for single sign-on.

**Prerequisite **

See [Configuring Mobile App Single Sign-on (SSO)](docId:4YogTGCLqWgWva1RjtgJ7)for information about setting up single sign-on.

**Procedure **

1. In the service provider configuration for Salesforce, Custom WS-Federation Service Provider or for Custom SAML Service Provider, go to Encryption Certificate.
2. Click the check box for Encrypt SAML assertion.

:::Paragraph{indent="1"}
The default encryption certificate is automatically selected.
:::

3. (Optional) To use a different certificate than the default certificate, do one of the following:
   - Select a certificate from the drop-down list.
   - Click Generate certificate or Add new certificate.

## Adding a new certificate for SAML assertion encryption

The following provides the steps for adding a new certificate for SAML assertion encryption.

**Prerequisite **

- Ensure that you have a PKCS 12 format file (.PFX or .P12) that contains the certificate and corresponding private key.

**Procedure **

1. In the service provider (SP) configuration, in the Encryption Certificate section, click Add new certificate.
2. Enter the following information:

| Item                 | Description                                                                                                        |
| -------------------- | ------------------------------------------------------------------------------------------------------------------ |
| Certificate Name     | Enter an identifying name for the encryption certificate.                                                          |
| Certificate Password | Enter the password for the encryption certificate.                                                                 |
| Choose File          | Click to navigate to the location of the encryption certificate or drag and drop the certificate to this location. |

3. Click <font color="#323232">Add Encryption Certificate</font> to add the new certificate.
   The certificate is now available to select from the drop-down list.
   The certificate is also listed in Profile >Access Certificates.

## Generating a certificate for SAML assertion encryption

The following provides the steps for generating a certificate for SAML assertion encryption.

**Procedure&#xA0;**

1. In the service provider (SP) configuration, in the Encryption Certificate section, click Generate certificate.
2. For <font color="#323232">Certificate Name</font>, enter a name to identify the certificate.
3. Click <font color="#323232">Generate Encryption Certificate</font>.
   The certificate is now available to select from the drop-down list.
   The certificate is also listed in Profile > Access Certificates.

Related topics 

• [Adding a new certificate for SAML assertion encryption](docId:4lH-c9Lp2P1n6iL6fkLcq)

- [Generating a certificate for SAML assertion encryption](docId:4lH-c9Lp2P1n6iL6fkLcq)