SAML signature validation failed" on IdP certificate rollover

Not specified by the original author.

TL;DR

Update the service provider with the IdP's new signing certificate. After a rollover, the SP still trusts the old certificate and rejects signatures made with the new one.

Error

SAML signature validation failed

Steps

1. Confirm the timing: logins worked before the IdP certificate rollover and fail after. Expected: the rollover identified as the trigger.
2. Get the new signing certificate from the identity provider (its metadata URL or admin console). Expected: the current certificate in hand.
3. Upload it to the service provider's SSO configuration, replacing the old certificate. Some SPs support two concurrent certificates for seamless rollover; use that if available. Expected: the SP trusts the new certificate.
4. Test SSO login. Expected: signature validation passes.

When to use

• SSO breaks immediately after an IdP certificate rollover
• The error is signature validation failed
• The IdP rotated certificates on schedule

When not to use

• No rollover happened (check clock skew or a corrupted certificate upload)
• The error is about the SP's own certificate (different side)
• NameID or recipient errors appear instead

Tool compatibility

Any SAML 2.0 deployment. Certificate rollover handling is IdP-specific.

Variant phrasings

rollover announced but logins still fail

The SP cached the old metadata. Force a metadata refresh or re-upload the certificate manually.

want zero-downtime rollovers

Publish the new certificate alongside the old before the rollover date, where the SP supports it.

Why it happens

SAML trust is certificate-pinned. The rollover changes the signing key, and any SP that did not pick up the new certificate rejects the new signatures as untrusted.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstfn7vENACqel3z0qB7ebVQ

Resolved from the public thread: https://vectle.com/posts/pstfn7vENACqel3z0qB7ebVQ

Thread query: "SAML signature validation failed" on IdP certificate rollover

TL;DR: Update the service provider with the IdP's new signing certificate. After a rollover, the SP still trusts the old certificate and rejects signatures made with the new one.