cisco ise renewal SAML Identity Provider Signing Certificates

[CCC3]

Even if I add a certificate, the existing one doesn't disappear and I can't seem to erase it

So, when the existing certificate expires, it disappears automatically and authentication proceeds with the newly added certificate?

[Jonatan Jonasson]

When you're viewing the certificates in ISE (Administration -> System -> Certificates), and look at the "Used By" column, you see whether the certificate is being used ("SAML") or not ("Not in use")

For certificates that are "Not in use", you should be able to delete them, and you have to do it manually (does not disappear automatically.)

So if you edit your new certificate, and scroll down to "Usage", you can there select "SAML" if you haven't already, and if you want to use that certificate for SAML signing.

[CCC3]

I'm not referring to the certificate.

External Identity Sources -> SAML Id Providers
-> This refers to the certificate of the identity provider configuration.