---
schema_version: "1"
id: dfba341072ee2bf55f2e86e7aa123c3de8b87edcc6d870c196470a8b7160b394
title: Enable Asserted Encryption with SSO
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/platform/264-0-0/platform_o_sso_enable_asserted_encrypt.md
canonical_url: https://help.salesforce.com/s/articleView?id=platform.platform_o_sso_enable_asserted_encrypt.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 3cfe9150d77f824c64cedf6b4bf9cda00a02e21a6cc3e04741035adb236bdfff
description: In order to meet FAL2 requirements, your IdP may need to sign assertions it generates. Find the variables you need to enter in your IdP to enable encrypted assertion.
products:
  - Security
  - Salesforce Platform
release: "264"
---
# Enable Asserted Encryption with SSO

In order to meet FAL2 requirements, your IdP may need to sign assertions it generates. Find the variables you need to enter in your IdP to enable encrypted assertion.

Encrypted assertion is not supported for the FedRAMP region.

## Create an Encryption Certificate

1. Follow the enablement steps in [Single Sign On (SSO)](https://help.salesforce.com/s/articleView?id=platform.platform_o_single_sign_on.htm&release=264.0.0&type=5 "Own from Salesforce supports single sign on using SAML 2.0. Instead of relying on local authentication for password and security policies, you can set your own authentication using your managed Identity Provider."), until your unique parameters are generated in Own.
2. Click Download XML File.
3. Open the downloaded file in a text editor that supports XML.
4. In the file that opens, use Ctrl + F to search for “<ds:X509Certificate>”.
5. Copy the value in between the “<ds:X509Certificate>” and “</ds:X509Certificate>” tags (without including the tags). This is your encryption certificate.
6. Open a new text file and paste the content into it. Save the file as a .pem file (for Azure Entra ID, save the file as a .cer file).
    
    You now have an encryption certificate file to upload to your IdP. Some IdPs also request the Encryption Algorithm and/or Key Transport Algorithm. The algorithms we use are:
    
    Encryption Algorithm: AES256-CBC
    
    Key Transport Algorithm: RSA-OAEP

Continue setting up your SAML app within your IdP.

## Set Up SAML App

Proceed according to your Identity Provider.

1. Okta - In the app's SAML Settings:
    1. Click Show Advanced Settings.
    2. In the Asserted Encryption drop-down, select Encrypted.
    3. In the Encryption Algorithm drop-down, select AES256-CBC.
    4. In the Key Transport Algorithm drop-down, select RSA-OAEP.
    5. Click Browse files… next to the Encryption Certificate field and upload your encryption certificate.
2. Azure Entra ID - In the application page:
    1. Select Token encryption.
    2. Click Import Certificate to upload your encryption certificate.
    3. Click the … menu next to the thumbprint status and select Activate token encryption certificate.
3. Salesforce - In the connected app page:
    1. Select Encrypt SAML Response to upload the encryption certificate.
    2. In the Encryption Method field, enter AES-256.
4. Ping - In the app’s Configuration tab:
    1. Select Encryption.
    2. Select AES\_256 as your algorithm for encrypting assertions.
    3. Import your encryption certificate.