Invalid Thumbprint for ADFS

Last Updated: Feb 20, 2026

Overview

Users with login trouble through an ADFS connection and the customer noticed that from Tenant Logs.

Cause

The most probable cause is that the certificate was not properly updated by ADFS.

We have also seen this error because the URL ( https://{adfs_domain}/FederationMetadata/2007-06/FederationMetadata.xml ) does not seem to support secure renegotiation. In April of 2023 we upgraded the API responsible for making this request to Node v18. As part of the upgrade, the OpenSSL lib was upgraded to 3.0 and the option SSL_OP_LEGACY_SERVER_CONNECT in the OpenSSL library went from enabled by default in version 1.1.1 to disabled by default in OpenSSL 3.0 (this is necessary for security as it addresses a vulnerability). There is nothing we can do on our end and the IdP would need to upgrade their endpoint to be compliant with the security spec (Secure Renegotiation). You can see references for this here:

Solution

Saving again the configuration for ADFS connection.

If the issue is due to the secure renegotiation issue, the IdP would need to upgrade their endpoint to be compliant with the security spec (Secure Renegotiation).