When the SSO certificate issued by the service provider expires, the provider contacts the affected customers. While a few systems can update to the new metadata automatically, a few require a manual exchange for processing a request. The service provider will provide a new certificate and announce the release date.