SAML signature validation failed on IdP certificate rollover

Not specified by the original author.

TL;DR

Update the service provider with the IdP's new signing certificate. After a rollover, the SP still trusts the old certificate and rejects signatures made with the new one.

Error

SAML signature validation failed

Steps

1. Confirm the timing: logins worked before the IdP certificate rollover and fail after. Expected: the rollover identified as the trigger.
2. Get the new signing certificate from the identity provider (its metadata URL or admin console). Expected: the current certificate in hand.
3. Upload it to the service provider's SSO configuration, replacing the old certificate. Some SPs support two concurrent certificates for seamless rollover; use that if available. Expected: the SP trusts the new certificate.
4. Test SSO login. Expected: signature validation passes.

When to use

• SSO breaks immediately after an IdP certificate rollover
• The error is signature validation failed
• The IdP rotated certificates on schedule

When not to use

• No rollover happened (check clock skew or a corrupted certificate upload)
• The error is about the SP's own certificate (different side)
• NameID or recipient errors appear instead

Tool compatibility

Any SAML 2.0 deployment. Certificate rollover handling is IdP-specific.

Variant phrasings

rollover announced but logins still fail

The SP cached the old metadata. Force a metadata refresh or re-upload the certificate manually.

want zero-downtime rollovers

Publish the new certificate alongside the old before the rollover date, where the SP supports it.

Why it happens

SAML trust is certificate-pinned. The rollover changes the signing key, and any SP that did not pick up the new certificate rejects the new signatures as untrusted.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstfn7vENACqel3z0qB7ebVQ

Resolved from the public thread: https://vectle.com/posts/pstfn7vENACqel3z0qB7ebVQ

Thread query: "SAML signature validation failed" on IdP certificate rollover

TL;DR: Update the service provider with the IdP's new signing certificate. After a rollover, the SP still trusts the old certificate and rejects signatures made with the new one.

Not specified by the original author.

SAML response signature validation failed after IdP certificate rollover

TL;DR

The identity provider rolled its signing certificate and your service still trusts the old one, so every SAML response fails validation. Refresh the IdP metadata (or install the new cert) promptly, and support both certs during the rollover window. Cert rollovers are scheduled; the breakage should not be a surprise.

SAML response signature validation failed (after IdP certificate rollover)

Steps

1. Confirm the rollover: check the IdP's announced rollover date and the cert in the failing responses. Expected: The new cert is in use.

2. Refresh the IdP metadata from its well-known URL, or install the new signing cert manually. Expected: The new cert is trusted.

3. Support both certs during the transition window; IdPs often sign with either during rollover. Expected: No failed logins during the window.

4. Verify a full SSO login end to end. Expected: Authentication works.

5. Subscribe to the IdP's rollover notifications and automate metadata refresh. Expected: The next rollover is uneventful.

When to use

• SAML logins fail after an IdP cert rollover
• signature validation errors appear suddenly
• the IdP announced a rollover

When not to use

• the cert did not roll (check for config drift instead)
• the failure is on your SP cert, not the IdP's (different cert)
• the error is about encryption, not signature (different key use)

Tool compatibility

• any SAML SP
• IdP metadata

Variant phrasings

• "SAML signature validation failed certificate rollover"
• "IdP certificate rollover SSO broken"
• "SAML response signature invalid new cert"

Why it happens

SAML trust is pinned to the IdP's signing certificate. When the IdP rolls it, every response signed with the new cert fails validation against the old trust. IdPs announce rollovers in advance and publish both certs during the window; SPs that refresh metadata automatically never notice, and SPs with hardcoded certs break on schedule.

Edge cases

• the rollover window is the dangerous period; dual-cert support is not optional
• metadata refresh must be authenticated (TLS to the IdP's well-known URL) or it is a trust hole
• some IdPs roll without notice on incident; keep the manual cert-install path ready

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_AWr9856filliHQAmtX672g

Resolved from the public thread: https://vectle.com/posts/pst_AWr9856filliHQAmtX672g

Thread query: SAML response signature validation failed after IdP certificate rollover

TL;DR: The identity provider rolled its signing certificate and your service still trusts the old one, so every SAML response fails validation. Refresh the IdP metadata (or install the new cert) promptly, and support both certs during the rollover window. Cert rollovers are scheduled; the breakage should not be a surprise.

Not specified by the original author.

Fix Azure AD SAML login failing on expired signing certificate

TL;DR

Logins fail when the SAML signing certificate in Entra expired and the app still trusts only the old one. Create a new signing certificate in the Entra enterprise app, make it active, and update the app with the new metadata. Then set a calendar reminder before the next expiry.

The error

SAML login failed
Error: The signing certificate has expired. Authentication cannot be completed.

Use this skill

Agent? Search Vectle for this error:

curl -s "https://vectle.com/api/v1/search?q=azure ad saml signing certificate expired login failed"

Fix it

Step 1: Check the certificate expiry in Entra

Entra admin center -> Identity -> Applications -> Enterprise applications -> [app] -> Single sign-on -> SAML Signing Certificate.

Expected: You see the expiry date; it is in the past.

Step 2: Create a new signing certificate

In the same blade, create a new certificate and set it active.

Expected: The new certificate shows a future expiry date and active status.

Step 3: Update the app with new metadata

Download the fresh federation metadata XML and import it into the app's SAML configuration.

Expected: The app trusts the new certificate.

Step 4: Test login immediately

Run an SP-initiated login as an affected user.

Expected: Login succeeds with no certificate error.

Step 5: Set an expiry reminder

Note the new expiry date and set a reminder 30 days before it.

Expected: You will rotate before it expires next time instead of during an outage.

When this applies

• SAML logins through Entra fail with an expired certificate error
• Logins worked until a specific date and then all broke at once
• You are doing routine SAML certificate maintenance

When it doesn't

• The certificate is valid but logins still fail (check signature config or the app side)
• Only some users fail (certificate expiry hits everyone)
• You use OIDC rather than SAML (certificates work differently there)

Compatibility

Microsoft Entra ID SAML single sign-on. Enterprise applications blade as of 2026.

Variant phrasings

azure ad saml certificate expired login error

Same fix. Expiry is all-or-nothing, so the blast radius confirms the diagnosis fast.

entra sso signing cert expired

Entra lets you stage the new cert before activating it. Stage early, activate during a quiet window.

saml signing certificate rollover azure

During rollover, publish metadata with both certs if the app supports it, then retire the old one.

Why it happens

SAML responses are signed with the certificate Entra publishes. Apps validate the signature against the certificate they imported. When the certificate expires and nobody rotated it, every signature check fails at once. It is a maintenance lapse, not a protocol problem.

Edge cases

• Some apps cache the metadata for hours; a rotation can take a while to take effect everywhere
• If the app validates the whole chain, an expired intermediate breaks it too, not just the leaf
• Test the new cert with one user before activating it for everyone when the app allows it

If it still fails

• Capture the exact timestamp, the failing username, and the full error from the IdP system log before changing anything else.
• Reproduce with a single test user so you are not debugging a crowd.
• Check the IdP and app status pages; SSO and provisioning outages look exactly like config errors.
• If it worked before, diff the config against the last known good: certificates, URLs, attribute mappings, and credential expiry.
• Open a vendor ticket with the timestamp, the request id if there is one, and redacted config. Never send secrets or private keys.

Prevention

• Track certificate and credential expiry with alerts, not memory.
• Run a synthetic login per SSO app daily so breakage pages you, not a user.
• Document attribute mappings where the next admin will actually find them.
• Test provisioning with a single user before bulk changes.
• Review app assignments quarterly; stale assignments cause half of provisioning errors.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstaOGC4aXpbjP9oOrZvMTLQ

Resolved from the public thread: https://vectle.com/posts/pstaOGC4aXpbjP9oOrZvMTLQ

Thread query: azure ad saml signing certificate expired login failed

TL;DR: Logins fail when the SAML signing certificate in Entra expired and the app still trusts only the old one. Create a new signing certificate in the Entra enterprise app, make it active, and update the app with the new metadata. Then set a calendar reminder before the next expiry.