OIDC Application Error "The remote certificate is invalid according to the validation procedure. IDX20803: Unable to obtain configuration"
Last Updated:
Okta Integration Network
Okta Classic Engine
Okta Identity Engine
API Access Management
Overview
Custom OIDC flow is failing with the following error:
The remote certificate is invalid according to the validation procedure. IDX20803: Unable to obtain configuration.
Applies To
-
OIDC Web Applications that are using .NET.
Cause
There are a number of causes for this error to occur such as:
- Network device (Palo Alto) is blocking traffic to Okta and is causing the authentication to fail.
- The client configuration is not using TLS 1.2.
- The issuer (or authority in some configurations) is not the issuer of the authorization server.
Solution
The following are some potential solutions to resolve this issue.
- Allowlist *.okta.com in the Palo Alto device for SSL decryption.
- Confirm that the client is able to connect to Okta endpoints using TLS 1.2.
- Confirm that the issuer matches the authorization server that is used. This can be found by viewing the /.well-known/open-id configuration endpoint.
