SSO certificate rollover with IdP should not

SSO certificate rollover with IdP should not have a hard sync requirement

Right now, SSO requires to have exactly one certificate from the IdP. As IdP certs nowadays need to be rolled over annually (or more often), there should be an option to upload a prospective "next certificate" so that the IdP can change the cert independently from the Webex admin updating SSO settings.

Also, there is no fallback auth available if that cert rollover fails (unless you happen to have the same browser session still open and your cookies haven't expired).