1

I am using OKTA as IDP. I am getting error on the picture

Azure AD: getting Invalid X509 certificate chain when Unbind with itfoxtec

I found this article and I have the same issue, but my IDP is OKTA. How can I obtain the root certificate for OKTA?

I cannot use "CertificateValidationMode": "None" because the Checkmarx code scan indicates that it is unsafe.

Therefore, I must obtain the root certificate to resolve this issue.

Please help me, as I have been stuck for several days.

Thanks a lot.

Walter Chen
  • 21
  • 3

3 Answers3

1

Okta's SAML certificates are usually self-signed ones. So it's the same certificate which you are getting when configuring SSO in Okta with a SAML app. It's a part of IdP's metadata also.

Philipp Grigoryev
  • 1,985
  • 3
  • 17
  • 23
1

I have solved the problem, and the steps are as follows:

  1. Save the X509Certificate from the IDP Metadata as a .crt file.
  2. Import the .crt file into the root certificates of the SP.
Walter Chen
  • 21
  • 3
0

You can also disable the certificate validation to enable self-signed certificates.

In config set "CertificateValidationMode": "None" and "RevocationMode": "NoCheck".
Shown in the ASP.NET Core sample application.

Anders Revsgaard
  • 3,636
  • 1
  • 9
  • 25