Issue
Several IdP servers (for example, ADFS) could change the active certificates 2-4 weeks before the certificate expires, causing alerts and authentication errors on your Multi-SSO configuration.
Symptoms
- An IDP Certificate Mismatch alert
- Several errors in the system logs showing "Invalid certificate"
- The SAML response from the IdP contains a different certificate to the one registered on the instance
Cause
When the IdP server changes the certificates, all the integrations need to update the certificate as well. Integrations using this IdP server need to update the certificate, causing authentication errors.
Resolution
Certificate Grouping enables you to have multiple certificates associated with the same IdP configuration.
To solve the issue:
- Retrieve or request the future valid certificate from your IdP server (for example, ADFS).
- Once received, add the certificate to the X.509 Certificates table.
- Open the Multi-SSO IdP record on the instance. On the list of certificates at the bottom, add the Signing certificate.
|
|
Warning: When adding the certificate to the Multi-SSO IdP record, add only the Signing certificate and not the encryption certificate. The encryption certificate can cause conflicts when validating the signatures. Also, adding the certificate to the instance X.509 Certificates table is not enough. You need to add the certificates to the idp_certificate table as well. |
Once the IdP server changes the certificate, remove the old certificate (which might not have expired yet) from the list.
Multiple certificates cause extra validations on each user login by SSO, which is an unwanted overhead.
