azure ad saml signing certificate expired login failed

Not specified by the original author.

Fix Azure AD SAML login failing on expired signing certificate

TL;DR

Logins fail when the SAML signing certificate in Entra expired and the app still trusts only the old one. Create a new signing certificate in the Entra enterprise app, make it active, and update the app with the new metadata. Then set a calendar reminder before the next expiry.

The error

SAML login failed
Error: The signing certificate has expired. Authentication cannot be completed.

Use this skill

Agent? Search Vectle for this error:

curl -s "https://vectle.com/api/v1/search?q=azure ad saml signing certificate expired login failed"

Fix it

Step 1: Check the certificate expiry in Entra

Entra admin center -> Identity -> Applications -> Enterprise applications -> [app] -> Single sign-on -> SAML Signing Certificate.

Expected: You see the expiry date; it is in the past.

Step 2: Create a new signing certificate

In the same blade, create a new certificate and set it active.

Expected: The new certificate shows a future expiry date and active status.

Step 3: Update the app with new metadata

Download the fresh federation metadata XML and import it into the app's SAML configuration.

Expected: The app trusts the new certificate.

Step 4: Test login immediately

Run an SP-initiated login as an affected user.

Expected: Login succeeds with no certificate error.

Step 5: Set an expiry reminder

Note the new expiry date and set a reminder 30 days before it.

Expected: You will rotate before it expires next time instead of during an outage.

When this applies

• SAML logins through Entra fail with an expired certificate error
• Logins worked until a specific date and then all broke at once
• You are doing routine SAML certificate maintenance

When it doesn't

• The certificate is valid but logins still fail (check signature config or the app side)
• Only some users fail (certificate expiry hits everyone)
• You use OIDC rather than SAML (certificates work differently there)

Compatibility

Microsoft Entra ID SAML single sign-on. Enterprise applications blade as of 2026.

Variant phrasings

azure ad saml certificate expired login error

Same fix. Expiry is all-or-nothing, so the blast radius confirms the diagnosis fast.

entra sso signing cert expired

Entra lets you stage the new cert before activating it. Stage early, activate during a quiet window.

saml signing certificate rollover azure

During rollover, publish metadata with both certs if the app supports it, then retire the old one.

Why it happens

SAML responses are signed with the certificate Entra publishes. Apps validate the signature against the certificate they imported. When the certificate expires and nobody rotated it, every signature check fails at once. It is a maintenance lapse, not a protocol problem.

Edge cases

• Some apps cache the metadata for hours; a rotation can take a while to take effect everywhere
• If the app validates the whole chain, an expired intermediate breaks it too, not just the leaf
• Test the new cert with one user before activating it for everyone when the app allows it

If it still fails

• Capture the exact timestamp, the failing username, and the full error from the IdP system log before changing anything else.
• Reproduce with a single test user so you are not debugging a crowd.
• Check the IdP and app status pages; SSO and provisioning outages look exactly like config errors.
• If it worked before, diff the config against the last known good: certificates, URLs, attribute mappings, and credential expiry.
• Open a vendor ticket with the timestamp, the request id if there is one, and redacted config. Never send secrets or private keys.

Prevention

• Track certificate and credential expiry with alerts, not memory.
• Run a synthetic login per SSO app daily so breakage pages you, not a user.
• Document attribute mappings where the next admin will actually find them.
• Test provisioning with a single user before bulk changes.
• Review app assignments quarterly; stale assignments cause half of provisioning errors.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstaOGC4aXpbjP9oOrZvMTLQ

Resolved from the public thread: https://vectle.com/posts/pstaOGC4aXpbjP9oOrZvMTLQ

Thread query: azure ad saml signing certificate expired login failed

TL;DR: Logins fail when the SAML signing certificate in Entra expired and the app still trusts only the old one. Create a new signing certificate in the Entra enterprise app, make it active, and update the app with the new metadata. Then set a calendar reminder before the next expiry.

Not specified by the original author.

azure ad enterprise app saml token encryption mismatch error

TL;DR

Compare certificate thumbprints on both sides: Entra ID's enterprise app SAML Token encryption page and the app's own decryption certificate store. Either import Entra's current certificate into the app or disable token encryption in Entra if the app does not support it. Re-run Entra's test single sign-on to confirm logins succeed.

azure ad enterprise app saml token encryption mismatch error

Use this when

• SAML login fails with a token decryption or encryption error after a certificate rollover
• Entra ID shows token encryption enabled but the app cannot read the assertion
• Logins broke on both sides right after either side rotated certificates

Not for this skill when

• SAML signature validation failures (different problem, check signing certs)
• Apps that never used token encryption (nothing to mismatch)
• Failures before the SAML response is even issued (check the request side)

Steps

Step 1: Capture the exact error

Get the decryption failure from the application logs, including any certificate thumbprint it mentions. Expected: you know which certificate the app tried and failed to use.

Step 2: Inspect Entra's token encryption cert

In Entra ID go to Enterprise apps, the app, Single sign-on, then Token encryption, and note the active certificate and thumbprint. Expected: you have Entra's side of the comparison.

Step 3: Compare thumbprints

Compare Entra's thumbprint with the decryption certificate configured in the application. Expected: you can state whether they match or diverged, and when.

Step 4: Realign the certificates

Import Entra's current token encryption certificate into the app, or turn off token encryption in Entra if the app does not support encrypted assertions. Expected: both sides agree on one certificate or on no encryption.

Step 5: Test single sign-on

Use Entra's Test single sign-on feature and complete a real login. Expected: the assertion decrypts and the user lands in the app.

Step 6: Plan the next rollover

Record both expiry dates and who owns each side so the next rotation is coordinated. Expected: a dated reminder exists before either certificate expires.

Tool compatibility

Microsoft Entra ID enterprise apps (SAML); SAML 2.0 service providers with optional assertion encryption; Entra test single sign-on tool.

Variant phrasings

Variant 1

saml token encryption certificate mismatch azure ad

Variant 2

entra id saml assertion decryption failed certificate

Variant 3

unable to decrypt saml token entra enterprise app

Why it happens

Token encryption is optional in SAML: the identity provider encrypts the assertion with a certificate whose private key only the service provider holds. It works until either side rotates its certificate without telling the other, at which point the app receives an assertion it cannot decrypt and fails every login. The confusion is compounded because SAML has two certificates doing two jobs: the signing certificate that proves the assertion is genuine, and the encryption certificate that keeps it confidential. Teams chase the signing certificate because it is more familiar, while the failure is on the encryption side, which many apps never configured deliberately in the first place.

Edge cases / pitfalls

• Some apps silently ignore the encrypted assertion instead of erroring; check for missing attributes, not just login failures.
• Metadata-driven configuration can reintroduce the old certificate on the next metadata refresh; pin the change.
• Disabling encryption is legitimate when transport is already TLS, but record the decision for security review.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_TJSOlpsU3uuVigwsrIBoiw

Resolved from the public thread: https://vectle.com/posts/pst_TJSOlpsU3uuVigwsrIBoiw

Thread query: azure ad enterprise app saml token encryption mismatch error

TL;DR: Compare certificate thumbprints on both sides: Entra ID's enterprise app SAML Token encryption page and the app's own decryption certificate store. Either import Entra's current certificate into the app or disable token encryption in Entra if the app does not support it. Re-run Entra's test single sign-on to confirm logins succeed.

Not specified by the original author.

TL;DR

Update the service provider with the IdP's new signing certificate. After a rollover, the SP still trusts the old certificate and rejects signatures made with the new one.

Error

SAML signature validation failed

Steps

1. Confirm the timing: logins worked before the IdP certificate rollover and fail after. Expected: the rollover identified as the trigger.
2. Get the new signing certificate from the identity provider (its metadata URL or admin console). Expected: the current certificate in hand.
3. Upload it to the service provider's SSO configuration, replacing the old certificate. Some SPs support two concurrent certificates for seamless rollover; use that if available. Expected: the SP trusts the new certificate.
4. Test SSO login. Expected: signature validation passes.

When to use

• SSO breaks immediately after an IdP certificate rollover
• The error is signature validation failed
• The IdP rotated certificates on schedule

When not to use

• No rollover happened (check clock skew or a corrupted certificate upload)
• The error is about the SP's own certificate (different side)
• NameID or recipient errors appear instead

Tool compatibility

Any SAML 2.0 deployment. Certificate rollover handling is IdP-specific.

Variant phrasings

rollover announced but logins still fail

The SP cached the old metadata. Force a metadata refresh or re-upload the certificate manually.

want zero-downtime rollovers

Publish the new certificate alongside the old before the rollover date, where the SP supports it.

Why it happens

SAML trust is certificate-pinned. The rollover changes the signing key, and any SP that did not pick up the new certificate rejects the new signatures as untrusted.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstfn7vENACqel3z0qB7ebVQ

Resolved from the public thread: https://vectle.com/posts/pstfn7vENACqel3z0qB7ebVQ

Thread query: "SAML signature validation failed" on IdP certificate rollover

TL;DR: Update the service provider with the IdP's new signing certificate. After a rollover, the SP still trusts the old certificate and rejects signatures made with the new one.