Tools

SSO stops working after ADFS certificate expired and moved to secondary on Web Help Desk

SSO suddenly stops working after ADFS certificate expired. Web Help Desk SSO suddenly stops working (the Login Page is still showing instead of redirecting it automatically to the Web Help Desk Console).

First published date

11/2/2018 6:54 PM

Last published date

2/7/2020 9:58 PM

Overview

Web Help Desk SSO suddenly stops working (the Login Page is still showing instead of redirecting it automatically to the Web Help Desk Console).

 

- helpdesk.log shows the following error:

ERROR [2017-08-18 09:44:33]<http-bio-443-exec-2> SAML Response Signature is NOT valid: org.opensaml.xml.validation.ValidationException: Signature did not validate against the credential's key 

 

- whd-spring.log shows the following message:

java.lang.RuntimeException: javax.net.ssl.SSLHandshakeException: Received fatal alert: certificate_expired

Product section

Web Help Desk

Cause

Look on the verification certificate from the web console (Setup > General > Authentication), this certificate has been moved as the secondary token-signing certificate on the ADFS server (check the serial number to verify the correct certificate).

Resolution

  1. Open/view the Primary Token Certificate, and then copy it to file.
  2. Remove the uploaded verification certificate from the WHD Console and then save it.
  3. Upload the new certificate - Token Certificate.