In this situation, it could mean one of two things. The first is that you're trying to use a cert chain and there is already a single cert in idpCert.pem. Some IdP's like Ping require you to remove that idpCert.pem. However, the more likely case here is that you have multiple single certs attached to your IdP metadata.xml file. Some IdP's such as ADFS and Azure (Entra) allow for Primary and Secondary IdP certs, which allow for seamless transition from expiring to new certs. However, Splunk does NOT accept two single certs in one metadata.xml file. Hence, your solution here is as below: 1. On the IdP, replace the expiring cert with the new cert 2. Disable secondary cert option 3. Download the new metadata.xml file 4. Upload the IdP metadata.xml file to Splunk UI > Save footnote: Splunk DOES accept cert chains, but that has to be manually uploaded and in the correct order as per KB below: https://community.splunk.com/t5/Deployment-Architecture/Problem-with-SAML-cert-quot-ERROR-UiSAML-Verification-of-SAML/m-p/322376#M12073
... View more
