diff --git a/docs/sources/enterprise/saml/enable-saml.md b/docs/sources/enterprise/saml/enable-saml.md
index 248f86d0073..d6e104d7a24 100644
--- a/docs/sources/enterprise/saml/enable-saml.md
+++ b/docs/sources/enterprise/saml/enable-saml.md
@@ -53,20 +53,9 @@ The base64-encoded values (`key.pem.base64, cert.pem.base64` files) are then use
 
 The keys you provide should look like:
 
-It should look like:
-
 ```
 -----BEGIN PRIVATE KEY-----
 ...
 ...
 -----END PRIVATE KEY-----
 ```
-
-If you have a key that looks like:
-
-```
------BEGIN CERTIFICATE-----
-...
-...
------END CERTIFICATE-----
-```
diff --git a/docs/sources/enterprise/saml/troubleshoot-saml.md b/docs/sources/enterprise/saml/troubleshoot-saml.md
index 90b47575904..678c105c197 100644
--- a/docs/sources/enterprise/saml/troubleshoot-saml.md
+++ b/docs/sources/enterprise/saml/troubleshoot-saml.md
@@ -34,6 +34,31 @@ We only support one private key format: PKCS#8.
 
 The keys may be in a different format (PKCS#1 or PKCS#12); in that case, it may be necessary to convert the private key format.
 
+The following command creates a pkcs8 key file.
+
 ```bash
-$ openssl pkcs8 -topk8 -nocrypt -in <yourkey> -out private.pem
+$ openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365 -nodes​
+```
+
+#### **Convert** the private key format to base64
+
+The following command converts keys to base64 format.
+
+Base64-encode the cert.pem and key.pem files:
+(-w0 switch is not needed on Mac, only for Linux)
+
+```sh
+$ base64 -w0 key.pem > key.pem.base64
+$ base64 -w0 cert.pem > cert.pem.base64
+```
+
+The base64-encoded values (`key.pem.base64, cert.pem.base64` files) are then used for certificate and private_key.
+
+The keys you provide should look like:
+
+```
+-----BEGIN PRIVATE KEY-----
+...
+...
+-----END PRIVATE KEY-----
 ```