Public search query: saml signing certificate expiring how to rotate without downtime