This is more or less the reverse of what's asked in [this question](https://security.stackexchange.com/questions/55127/should-every-saml-identity-provider-provide-a-unique-public-certificate-to-the-s).

---

I recently added SSO with SAML to a SaaS Web application making said application the Service Provider (SP). This is done so customers (companies) can use their existing Identity Provider (IdP) such that the users (the companies' employees) don't have to maintain credentials in our Web application but can simply continue to use their existing local accounts.

In SAML, the SP sends an authentication request to the IdP which answers with an assertion that provides authentication information about the user that wants to log in. In order for both parties (SP and IdP) to be sure that request and response are not fabricated by a wire tapper, they are signed with a private key. The certificate used to check the signatures of requests and responses have been exchanged beforehand as part of the SAML Metadata exchange that is done manually by the administrators of the involved parties.

The question is: **Are there significant downsides to the security of this system if I use the same public/private key pair for all customers or is it advisable to go through the hoops of creating a separate key pair for each individual customer?**

---

I'm explicitly asking about the security of this issue. I know that if I have to exchange the key due to a security problem, all customers will have to update their IdP to incorporate the new certificate. I haven't made up my mind yet but I lean towards thinking that this is an acceptable risk. Those keys would be stored next to each other; a breach of any description would require new keys for all customers anyway.