2

SSO was working fine, next day it stopped working: (been working for 7+ years)

I get this Google Error:

  1. That’s an error.

Error: malformed_certificate

Error while signing data with certificate

7 years ago I set this up, I think the below is my complete setup.

Maybe I should just recreate the entire SSO setup ????

I will provide screen shots on this post but wanted to get this question asked about the Error. For now maybe some knows this error message?

Setup:

  • Google SAML Single Sign-On setup at Googles end, I have a field on the Google Users Account with their Fed Id.
  • Not using an Auth Provider. (not this:)
  • SSO Added to My Domain Setup.

I think I followed a document like this back in the day: Configure a Google Authentication Provider but I am sure there was more too it. like setting up custom fields??? :) but I do not think some custom fields would be the cause of this stopping, unless there was a Salesforce Security change that meant my config was now insecure (no recent releases), a few minor changes in audit log by salesforce, but nothing of interest.

UPDATE:

I found an expired Cert at my end: So I reset(unexpired) my Cert for the SSO, and this made no change to the error, it has been expired for a while now. :)

I also found SSO setup refers to an expired Google Cert. Here is the Google Article to fix. Google Article to reset Cert:

so went here saw the expired cert and: pressed the "ADD CERTIFICATE" Button, Done. then back into my salesforce SSO setting to edit and re-add the google cert to Identity Provider Certificate.

See Identity Provider Certificate Below (expired) - this got fixed.

The catch 22 here is you have to login to be able to fix this. luckily I recently gave myself PW_UN login access. otherwise I would have been locked out maybe???

I also cleared my Cookies, and tried in incognito mode (no luck)

enter image description here

Improve this question
4
  • Was this prompted by the answer on the question? If so it'd be good to accept that, otherwise it's best for you to post an answer to your own question than update the question itself, if you worked it out. If you have a new question it's best practice to post that as a new one rather than modify the original too.
    – Matt Lacey ♦
    Commented Jan 27, 2022 at 13:31
  • You haven't looked at the configuration of your CRM's primary authentication mechanism in 7 years? ... And we wonder how data breaches happen... :rolling eyes gif:
    – Andrew K.
    Commented Jan 27, 2022 at 15:09
  • Matt, no it wasn't the answer submitted did not read my question. Please note the timings of the answer versus the edit.
    – TheArchitecta
    Commented Jan 27, 2022 at 21:05
  • 1
    Andrew, lots of assumptions being thrown around by you. I have looked at it numerous times. And it is not a primary CRM, nor the primary authentication. It also uses 2 factor authentication. But please do share your expertise as to how it could be done better. Hence the point Stack exchange.
    – TheArchitecta
    Commented Jan 27, 2022 at 21:06

2 Answers 2

Reset to default
4

This happened to me and here's what I did:

  1. Like in your update, I went to Security -> Authentication -> SSO With SAML Applications and found an expired certificate.
  2. I clicked the "Add Certificate" button and to my surprise it REPLACED the old cert with a new one. The new one expires in 3 years.
  3. Still in admin.google.com, I then went to Apps -> Web and mobile apps and found the application (in my case using AWS Cognito) that was using Google as it's IDP. I clicked on the app's name.
  4. I then saw a big red warning triangle in the certificate field. I clicked the chevron on the far right to expand that section.
  5. I picked my new certificate, clicked Save.
  6. I clicked "Download Metadata" on the left and re-uploaded that to Cognito
  7. Then it seems I had to wait around for ~20 mins. I tried a bunch of different things, I re-uploaded the cert a couple of times, I used the restroom.

Then it just magically worked. I hope those steps help the next poor soul that encounters this problem.

Improve this answer
1
  • 1
    This was exactly what I needed, I missed the bit where I needed to assign a new cert in step 3. Thank you!
    – javex
    Commented Jun 27, 2023 at 12:24
0

The certificate might have got expired. I see that Identity Provider Certificate expired on Jan 22nd. Probably that's the cause of this problem. Please try uploading a new certificate.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .