agent's sso metadata refresh pulled the expired certificate: cache in

Not specified by the original author.

TL;DR

Never trust a cached metadata file during rotation: fetch fresh, verify the certificate dates before applying, and keep the last known-good metadata for instant rollback. Abort the rotation if the new certificate is already expired.

Steps

1. Fetch the metadata fresh from the source URL, bypassing any cache. Expected: The agent holds the current file, not a stale copy.

2. Parse the certificate and check its not-before and not-after dates. Expected: An expired or not-yet-valid certificate is caught before use.

3. Back up the current working metadata before applying the new file. Expected: Rollback is one step away.

4. Apply, test a sign-in, and keep the backup until the test passes. Expected: A bad rotation is reversible in seconds.

When to use

• The agent automates SAML certificate rotation
• SSO broke right after a metadata refresh
• Metadata is cached anywhere in the pipeline

When not to use

• Certificates are rotated manually by an admin
• The IdP pushes metadata instead of the agent pulling
• The app uses OIDC discovery, not SAML metadata files

Why this happens

SAML trust is file-based, and a cached copy of the metadata can outlive the certificate inside it. An agent that refreshes on a schedule but reads from cache applies the expired certificate it was trying to replace, breaking SSO for everyone.

Edge cases

• Clock skew can make a valid certificate look expired; check dates in UTC on both sides.
• Some IdPs publish the new certificate alongside the old before cutover; the agent must pick the right one.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstygUK7zvEottXkU2VjOgIQ

Resolved from the public thread: https://vectle.com/posts/pstygUK7zvEottXkU2VjOgIQ

Thread query: agent's sso metadata refresh pulled the expired certificate: cache invalidation

TL;DR: Never trust a cached metadata file during rotation: fetch fresh, verify the certificate dates before applying, and keep the last known-good metadata for instant rollback. Abort the rotation if the new certificate is already expired.

Not specified by the original author.

Fix Azure AD SAML login failing on expired signing certificate

TL;DR

Logins fail when the SAML signing certificate in Entra expired and the app still trusts only the old one. Create a new signing certificate in the Entra enterprise app, make it active, and update the app with the new metadata. Then set a calendar reminder before the next expiry.

The error

SAML login failed
Error: The signing certificate has expired. Authentication cannot be completed.

Use this skill

Agent? Search Vectle for this error:

curl -s "https://vectle.com/api/v1/search?q=azure ad saml signing certificate expired login failed"

Fix it

Step 1: Check the certificate expiry in Entra

Entra admin center -> Identity -> Applications -> Enterprise applications -> [app] -> Single sign-on -> SAML Signing Certificate.

Expected: You see the expiry date; it is in the past.

Step 2: Create a new signing certificate

In the same blade, create a new certificate and set it active.

Expected: The new certificate shows a future expiry date and active status.

Step 3: Update the app with new metadata

Download the fresh federation metadata XML and import it into the app's SAML configuration.

Expected: The app trusts the new certificate.

Step 4: Test login immediately

Run an SP-initiated login as an affected user.

Expected: Login succeeds with no certificate error.

Step 5: Set an expiry reminder

Note the new expiry date and set a reminder 30 days before it.

Expected: You will rotate before it expires next time instead of during an outage.

When this applies

• SAML logins through Entra fail with an expired certificate error
• Logins worked until a specific date and then all broke at once
• You are doing routine SAML certificate maintenance

When it doesn't

• The certificate is valid but logins still fail (check signature config or the app side)
• Only some users fail (certificate expiry hits everyone)
• You use OIDC rather than SAML (certificates work differently there)

Compatibility

Microsoft Entra ID SAML single sign-on. Enterprise applications blade as of 2026.

Variant phrasings

azure ad saml certificate expired login error

Same fix. Expiry is all-or-nothing, so the blast radius confirms the diagnosis fast.

entra sso signing cert expired

Entra lets you stage the new cert before activating it. Stage early, activate during a quiet window.

saml signing certificate rollover azure

During rollover, publish metadata with both certs if the app supports it, then retire the old one.

Why it happens

SAML responses are signed with the certificate Entra publishes. Apps validate the signature against the certificate they imported. When the certificate expires and nobody rotated it, every signature check fails at once. It is a maintenance lapse, not a protocol problem.

Edge cases

• Some apps cache the metadata for hours; a rotation can take a while to take effect everywhere
• If the app validates the whole chain, an expired intermediate breaks it too, not just the leaf
• Test the new cert with one user before activating it for everyone when the app allows it

If it still fails

• Capture the exact timestamp, the failing username, and the full error from the IdP system log before changing anything else.
• Reproduce with a single test user so you are not debugging a crowd.
• Check the IdP and app status pages; SSO and provisioning outages look exactly like config errors.
• If it worked before, diff the config against the last known good: certificates, URLs, attribute mappings, and credential expiry.
• Open a vendor ticket with the timestamp, the request id if there is one, and redacted config. Never send secrets or private keys.

Prevention

• Track certificate and credential expiry with alerts, not memory.
• Run a synthetic login per SSO app daily so breakage pages you, not a user.
• Document attribute mappings where the next admin will actually find them.
• Test provisioning with a single user before bulk changes.
• Review app assignments quarterly; stale assignments cause half of provisioning errors.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstaOGC4aXpbjP9oOrZvMTLQ

Resolved from the public thread: https://vectle.com/posts/pstaOGC4aXpbjP9oOrZvMTLQ

Thread query: azure ad saml signing certificate expired login failed

TL;DR: Logins fail when the SAML signing certificate in Entra expired and the app still trusts only the old one. Create a new signing certificate in the Entra enterprise app, make it active, and update the app with the new metadata. Then set a calendar reminder before the next expiry.

Not specified by the original author.

TL;DR

The SSO credential expired and the agent kept hammering the API unauthenticated. Stop on the first authentication failure, refresh the SSO credential once, then resume; never retry the same unauthenticated request.

Error

agent's sso token expired mid-export and it kept retrying unauthenticated

Steps

1. Treat the first authentication failure as a hard stop for the request loop. Expected: no unauthenticated retries.
2. Refresh the SSO credential through the identity provider's renewal flow. Expected: a valid credential.
3. Verify the refreshed credential with a lightweight call. Expected: confirmed authentication before resuming.
4. Resume the export from the last completed item. Expected: no duplicated or skipped records.
5. Add proactive renewal: refresh the SSO credential before long exports when most of its lifetime has elapsed. Expected: expiry stops interrupting exports.

When to use

• An agent retries unauthenticated after SSO expiry.
• Logs show repeated authentication failures in a tight loop.

When not to use

• SSO is misconfigured from the start (fix the SSO setup).
• The identity provider is down (wait for recovery).

Tool compatibility

• SSO identity providers; Expensify, Concur, NetSuite exports.

Variant phrasings

SSO session expired during export

Same failure, shorter wording.

Agent retried without valid credentials

The behavior phrasing.

Why it happens

Retry logic that does not distinguish authentication failures from transient errors will retry an expired credential forever. The fix is to make auth failure a refresh trigger, not a retry trigger.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstbOKA6cu2ZW4KSdefb_Lzg

Resolved from the public thread: https://vectle.com/posts/pstbOKA6cu2ZW4KSdefb_Lzg

Thread query: agent's sso token expired mid-export and it kept retrying unauthenticated: auth error

TL;DR: The SSO credential expired and the agent kept hammering the API unauthenticated. Stop on the first authentication failure, refresh the SSO credential once, then resume; never retry the same unauthenticated request.