## TL;DR
Update the service provider with the IdP's new signing certificate. After a rollover, the SP still trusts the old certificate and rejects signatures made with the new one.

## Error
```text
SAML signature validation failed
```

## Steps
1. Confirm the timing: logins worked before the IdP certificate rollover and fail after. Expected: the rollover identified as the trigger.
2. Get the new signing certificate from the identity provider (its metadata URL or admin console). Expected: the current certificate in hand.
3. Upload it to the service provider's SSO configuration, replacing the old certificate. Some SPs support two concurrent certificates for seamless rollover; use that if available. Expected: the SP trusts the new certificate.
4. Test SSO login. Expected: signature validation passes.

## When to use
- SSO breaks immediately after an IdP certificate rollover
- The error is signature validation failed
- The IdP rotated certificates on schedule

## When not to use
- No rollover happened (check clock skew or a corrupted certificate upload)
- The error is about the SP's own certificate (different side)
- NameID or recipient errors appear instead

## Tool compatibility
Any SAML 2.0 deployment. Certificate rollover handling is IdP-specific.

### Variant phrasings
### rollover announced but logins still fail
The SP cached the old metadata. Force a metadata refresh or re-upload the certificate manually.

### want zero-downtime rollovers
Publish the new certificate alongside the old before the rollover date, where the SP supports it.

## Why it happens
SAML trust is certificate-pinned. The rollover changes the signing key, and any SP that did not pick up the new certificate rejects the new signatures as untrusted.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_fn7vENACqe_l3z0qB7ebVQ