In Summer ’26, SAML single sign-on (SSO) configurations that use the Triple Data Encryption Standard (Triple DES) algorithm will stop working. This change applies to all SSO configurations that use the Triple DES algorithm, whether you use Salesforce as an identity provider or as a service provider. To improve security, use the Advanced Encryption Standard (AES) algorithms, AES 128 or AES 256, instead.
Where: This change applies to Lightning Experience and Salesforce Classic (not available in all orgs) in all editions.
When: Triple DES will stop working in Summer ’26. There’s no change to Triple DES support in Spring ’26, but we recommend that you update your SAML configurations as soon as possible.
Why: The Triple DES algorithm uses a cryptographic key that’s too short to be secure. The AES 128 and AES 256 algorithms use longer keys that make these algorithms harder to attack. For more information about encryption algorithm security from the National Institute of Standards and Technology, go to https://csrc.nist.gov/pubs/sp/800/131/a/r3/ipd.
How: Before Summer ’26, update your configurations to use the AES 128 or AES 256 algorithm. The steps to update your configuration are different depending on whether you use Salesforce as an identity provider or as a service provider.
- If you use Salesforce as an identity provider, check your connected app SAML configuration.
First, go to your connected app Web App Settings and check the Block Encryption Algorithm
setting. If Block Encryption Algorithm is set to Triple DES, update your configuration to use a
more secure algorithm. On the service provider, update your settings to decrypt the new algorithm.
- If you use Salesforce as a service provider, check with your identity provider to see what
encryption algorithm they use. If they use the Triple DES algorithm, work with your identity
provider to use a more secure algorithm and to generate a new decryption certificate. In
Salesforce, update the Assertion Decryption Certificate in your SAML Single Sign-On Settings.
