Introduction

After you renew or rotate the SAML signing certificate at your identity provider (IdP), users can no longer log in to Zivver. This can affect the Admin Panel, WebApp, Chrome Extension, Outlook Web Access (OWA), and the Office plugin all at the same time, because these products share the same SSO configuration. You may see errors such as:

"error": "SAML response was not properly signed. Make sure to sign at least the SAML response or the assertion(s)."

or a certificate error, or a blank SSO login panel.

This applies regardless of which identity provider you use, for example Entra ID, AD FS, Okta, or Google Workspace.

Cause

Zivver caches SSO metadata, including the signing certificate, for up to 24 hours instead of fetching it on every login. After you renew the certificate at your identity provider, Zivver keeps validating logins against the old, cached certificate until the cache expires.

Resolution

1. At your identity provider, confirm the new certificate is active and export its federation metadata as an XML file.
   See your identity provider’s setup guide for where to find this: Entra ID (or the Entra ID certificate renewal guide for the exact steps), AD FS, Okta, Google Workspace.
2. Log in to the Zivver WebApp.
3. Click Organization Settings.
4. Expand User administration.
5. Click Single Sign-on.
6. Select Manually.
7. Paste the new federation metadata XML into the Identity Provider’s .XML field.
8. Click Save.
   This immediately restores login for the Admin Panel, WebApp, Chrome Extension, OWA, and Office plugin, since they all use this one SSO configuration.
9. Wait at least 24 hours for the old cached metadata to expire.
10. Select Automatically again.
11. Enter the Metadata URL in the URL field.
12. Click Save.
    This makes sure future certificate renewals are picked up automatically.

Note

This procedure is the same for every identity provider. Only the way you export the new federation metadata in step 1 differs per provider.