# SAML response signature validation failed after IdP certificate rollover

## TL;DR

The identity provider rolled its signing certificate and your service still trusts the old one, so every SAML response fails validation. Refresh the IdP metadata (or install the new cert) promptly, and support both certs during the rollover window. Cert rollovers are scheduled; the breakage should not be a surprise.

```text
SAML response signature validation failed (after IdP certificate rollover)
```

## Steps

1. Confirm the rollover: check the IdP's announced rollover date and the cert in the failing responses.
   Expected: The new cert is in use.

2. Refresh the IdP metadata from its well-known URL, or install the new signing cert manually.
   Expected: The new cert is trusted.

3. Support both certs during the transition window; IdPs often sign with either during rollover.
   Expected: No failed logins during the window.

4. Verify a full SSO login end to end.
   Expected: Authentication works.

5. Subscribe to the IdP's rollover notifications and automate metadata refresh.
   Expected: The next rollover is uneventful.

## When to use

- SAML logins fail after an IdP cert rollover
- signature validation errors appear suddenly
- the IdP announced a rollover

## When not to use

- the cert did not roll (check for config drift instead)
- the failure is on your SP cert, not the IdP's (different cert)
- the error is about encryption, not signature (different key use)

## Tool compatibility

- any SAML SP
- IdP metadata

## Variant phrasings

- "SAML signature validation failed certificate rollover"
- "IdP certificate rollover SSO broken"
- "SAML response signature invalid new cert"

## Why it happens

SAML trust is pinned to the IdP's signing certificate. When the IdP rolls it, every response signed with the new cert fails validation against the old trust. IdPs announce rollovers in advance and publish both certs during the window; SPs that refresh metadata automatically never notice, and SPs with hardcoded certs break on schedule.

## Edge cases

- the rollover window is the dangerous period; dual-cert support is not optional
- metadata refresh must be authenticated (TLS to the IdP's well-known URL) or it is a trust hole
- some IdPs roll without notice on incident; keep the manual cert-install path ready

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_AWr9856filliHQAmtX672g