---
title: Encrypting SAML assertions
slug: access/guide/encrypting-saml-assertions
docTags: 
createdAt: 2026-09-07T09:10:59.963Z
---

Enabling encryption of SAML assertions adds another layer of security. Enable this feature in a mobile app single sign-on setup if the SP supports SAML assertion decryption. The SAML assertions are encrypted such that the assertions can be decrypted only with the private keys held by the service provider.

- Encryption of SAML assertions is disabled by default.
- Responses can be signed while carrying a signed encrypted Assertion, but the Response itself is not encrypted.
- Do not use the signing certificate for encrypting SAML assertions and vice-versa.
- The following service providers (SP) support encryption of SAML assertions:
  - Salesforce
  - Custom SAML Service Provider
  - Custom WS-Federation Service Provider
- A default certificate for encryption is automatically available in your Ivanti Access tenant.
- Enabling SAML assertion encryption, enables additional options for Native Mobile Application Single Sign-On (SSO). These options allow you select the data encryption algorithm and the key transport algorithm for single sign-on.

Before you begin 

See [Configuring Mobile App Single Sign-on (SSO)](docId\:seXrYgFod9uTv6_fF9pfQ)for information about setting up single sign-on.

**Procedure **

|   | 1. | In the service provider configuration for Salesforce, Custom WS-Federation Service Provider or for Custom SAML Service Provider, go to Encryption Certificate. |
| - | -- | -------------------------------------------------------------------------------------------------------------------------------------------------------------- |

|   | 2. | Click the check box for Encrypt SAML assertion. |
| - | -- | ----------------------------------------------- |

The default encryption certificate is automatically selected.

|   | 3. | (Optional) To use a different certificate than the default certificate, do one of the following: |
| - | -- | ------------------------------------------------------------------------------------------------ |

|   | - | select a certificate from the drop-down list. |
| - | - | --------------------------------------------- |

|   | - | click Generate certificate or Add new certificate. |
| - | - | -------------------------------------------------- |

## Adding a new certificate for SAML assertion encryption

The following provides the steps for adding a new certificate for SAML assertion encryption.

Before you begin 

- Ensure that you have a PKCS 12 format file (.PFX or .P12) that contains the certificate and corresponding private key.

**Procedure **

1. In the service provider (SP) configuration, in the Encryption Certificate section, click Add new certificate.
2. Enter the following information:

| Item                 | Description                                                                                                        |
| -------------------- | ------------------------------------------------------------------------------------------------------------------ |
| Certificate Name     | Enter an identifying name for the encryption certificate.                                                          |
| Certificate Password | Enter the password for the encryption certificate.                                                                 |
| Choose File          | Click to navigate to the location of the encryption certificate or drag and drop the certificate to this location. |

3. Click <font color="#323232">Add Encryption Certificate</font> to add the new certificate.
   The certificate is now available to select from the drop-down list.
   The certificate is also listed in Profile >Access Certificates.

## Generating a certificate for SAML assertion encryption

The following provides the steps for generating a certificate for SAML assertion encryption.

**Procedure&#xA0;**

1. In the service provider (SP) configuration, in the Encryption Certificate section, click Generate certificate.
2. For <font color="#323232">Certificate Name</font>, enter a name to identify the certificate.
3. Click <font color="#323232">Generate Encryption Certificate</font>.
   The certificate is now available to select from the drop-down list.
   The certificate is also listed in Profile > Access Certificates.

Related topics 

|   | • | [Adding a new certificate for SAML assertion encryption](docId\:i5DOc6aKSOCXLD0cczqPh) |
| - | - | -------------------------------------------------------------------------------------- |

- [Generating a certificate for SAML assertion encryption](docId\:i5DOc6aKSOCXLD0cczqPh)