# SAML und Keycloak RSA key rotation

**URL:** <https://forum.keycloak.org/t/saml-und-keycloak-rsa-key-rotation/17842>\
**Category:** Configuring the server\
**Tags:** saml\
**Created:** [October 7, 2022, 1:47pm UTC](https://forum.keycloak.org/t/saml-und-keycloak-rsa-key-rotation/17842 "2022-10-07T13:47:54Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![mfriedenhagen](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/mfriedenhagen/32/6383_2.png) [@mfriedenhagen](https://forum.keycloak.org/u/mfriedenhagen)\
**Post date:** [October 7, 2022, 1:47pm UTC](https://forum.keycloak.org/t/saml-und-keycloak-rsa-key-rotation/17842/1 "2022-10-07T13:47:54Z")

</div>

Hello,

after reading [the recommendation](https://www.keycloak.org/docs/latest/server_admin/index.html#realm_keys) to rotate the RSA key periodically, I wonder how this will work with SAML.

While OIDC is able to retrieve the new key from the `jwks_uri`, at least in the systems I tried (GitLab, Artifactory, SonarQube), for SAML you need to configure either the public key or the fingerprint of the private certificate so that the service provider/client is able to verify the signature of assertions in the SAML response.

I do not see neither in SonarQube or Artifactory nor in GitLab how to add multiple fingerprints/public keys so I would have to immediately replace this over there when rotating the RSA key.

Where is my mistake in thought here :-)?

Regards  
Mirko