00uiqu2y6tWoCWcUK0h1.5465279570705283E12 (Customer) asked a question.
SAML is returning Unknown Issuer when signature certificate is validated and without certificate validation the the assertion endpoint(ACS) redirection lead to Http 500
I am creating a request with the the signature certificate to the Okta Saml. The signature certificate type is ".pfx " at c* side code from where i am trying to connect to SAML. At OKTA end, I am not able to upload the certificate of ".pfx" type , so I have converted ".pfx" certificate to ".pem" type and uploaded the same. when I am validating the request by checking the checkbox "Validate SAML request with signature certificate" then it throw an error of unknown issuer. Attaching the screenshot for same
if i uncheck this flag ( validate SAML request with signature certificates) , the redirection is happening to ACS endpoint but with http status code 500. Please guide me to resolve this issue.
Hi @00uiqu2y6tWoCWcUK0h1.5465279570705283E12 (Customer) , Thank you for reaching out to the Okta Community!
Unfortunately, the 400 error could be caused by any number of misconfigurations so I won’t be able to provide an explicit solution, but I can share with you the general guides to help you with the configuration and some older posts that discussed this topic for additional insights into what might be happening.
https://support.okta.com/help/s/article/How-To-Configure-A-Custom-SAML-App?language=en_US
https://help.okta.com/oie/en-us/content/topics/apps/apps_app_integration_wizard_saml.htm#
https://support.okta.com/help/s/question/0D54z00008LSLMsCAP/saml-signed-requests-failing-with-error-code-400-sp-initiated-sso-flow?language=en_US
https://support.okta.com/help/s/question/0D54z00009gRLhcCAG/getting-error-unknown-issuer-with-signed-requests-saml-2?language=en_US
If my answer helped, remember to mark it as best to increase its visibility for other members of the Okta Community who might have the same questions as you.
Hope my answer helps!
--------------------------------
Ask the Experts: Now Thru 1/31 Okta FastPass Engineering and Product Teams Answer Your Questions
Hello Mihai Negoita ,
Thanks for the reply, but none of the above worked for us. Can you help us Why the response is failing with 500 to ACS endpoint without the signed certificate. How we can map our own signed certificate without and response should not be "unknown issuer"