Dynatrace SAML certificate upload

[MichalP]

Hi, 

I am working with DynaTrace along with Azure. I have followed steps in Documentation and downloaded official cert - than I have uploaded it in SAML-based Sign-on section (in Verification certificates (optional)) - as per documentation.

Than users could not login. I have than created new cert in Token signing certificate section, but users got 400 error.

How can I upload cert to make it work? 

I still have that information after logging; 

[AntonPineiro]

Hi,

Sharing this in case is useful.

Best regards

[MichalP]

Accualy I have gone through this page, but no success. Any other suggestions?

[PacoPorro]

Did you try to disable "Require Verification Certificates" in Azure?
https://docs.dynatrace.com/docs/shortlink/mandatory-saml-cert-migration#require-verification-certifi...

[MichalP]

In fact it is disabled by default, all the time in Microsoft Entra. If I switch it on user loose connectivity.

[MichalP]

is the certificate on page usefull at all in this case?

[PacoPorro]

---

@MichalP wrote:

is the certificate on page usefull at all in this case?

---

As per the doc:

Dynatrace SSO will use the old certificate when signing SAML messages until you perform the migration described in this document. In such cases, adding the new certificate and enabling the "Require Verification Certificates" option will break the federation because Azure would attempt to verify the signature using the new certificate. In contrast, SSO would still use the same one. To transparently switch the signing certificate while retaining the signature verification, please add both certificates - the old one (down below) and the new one (provided above). Having both certificates in place, Azure would choose the right one, regardless of which SSO used one to sign the SAML message.

[MichalP]

Can you pls provide the source of this article? 

[PacoPorro]

As recommended by @tijust1 , your option is a support ticket.

[MichalP]

I have tried to upload both but still same error.

[tijust1]

@MichalP No other choice except open a support ticket and involve Dynatrace engineer. i feel that's the only way to fix this. I have updated but didn't encounter this kind of issue.