Troubleshooting

Unknown certificate / signature matches no certificate

The certificate configured in the application is not the one that signs. Very often, the IdP renewed its certificate and the application kept the old one.

"Unknown certificate" / "signature does not match any certificate"Signature

Probable cause. The certificate configured in the application is not the one that signs. Very often, the IdP has renewed its certificate and the application kept the old one.

What to do? Re-import the IdP's current metadata, or copy its current signing certificate. To avoid a cutover break, the IdP should publish both the old and the new one during the transition.

To see exactly which check fails, paste the response into theanalyseur, or paste the message into the diagnostic.

Related errors

All SAML and OpenID Connect errors

Want to see it for real? ID-Kit plays the role you are missing and shows you each step.

Open my spaceDecode a SAML response