Uploading a new encryption certificate for a Security Assertion Markup Language (SAML) application can cause Okta to generate an encryption error during Single Sign-On (SSO) if the certificate is faulty or fails Federal Information Processing Standards (FIPS) compliance. Inspecting the certificate for proper key usage and configuring the encryption algorithm to AES256-GCM resolves the issue.
When attempting to authenticate into the application, Okta generates the following error:
HTTP 400 BAD REQUEST
Your request resulted in an error. Error encrypting SAML assertion
- Okta Identity Engine (OIE)
- Okta Classic Engine
- Single Sign-On (SSO)
- Okta Integration Network (OIN)
- Security Assertion Markup Language (SAML)
- Encrypted SAML
- Custom SAML App Integrations
Okta generates this error due to one of the following scenarios:
- The uploaded certificate is faulty, lacks encryption capabilities, or uses a legacy hash algorithm.
- The Okta tenant enforces FIPS, and the configured encryption algorithms fail FIPS compliance standards. This only impacts product environments that support FIPS.
How is the SAML assertion encryption error resolved?
Inspect the certificate to verify encryption support, and configure the encryption algorithm to meet Federal Information Processing Standards (FIPS) requirements if the Okta tenant enforces them.
- Inspect the certificate to verify it supports encryption by checking the following requirements outlined in the About certificates documentation:
- Key Usage: Ensure the certificate includes "Digital Signature" and "Key Encipherment".
- A minimum hash algorithm of SHA-256.
- A minimum key type of RSA2048.
- Certificate chains should concatenate all certificates in order from the entity to the trusted root. If multiple intermediate certificates exist, include them in the chain in the following order: Entity > Intermediary > Root Certificate Authority (CA).
- If the Okta tenant enforces FIPS compliance and requires SAML encryption with a custom SAML application, configure the Encryption Algorithm to AES256-GCM.
