ACME HQDemo work items and pages, made up for Emargen's demo. Not a real company.

Engineering / ENG-1625

Metadata with two signing certificates: only the first is kept

Project: Engineering
Type: Bug
Status: Done Done
Priority: High
Reporter: Hanna Virtanen <hanna.virtanen@acme-hq.example>
Assignee: Marek Nowak <marek.nowak@acme-hq.example>
Labels: single-sign-on
Components: identity-service
Fix versions: identity-service 2026.08.14
Sprint: Sprint 48
Parent: ENG-1522 SAML metadata upload
Created: 12 Aug 2026, 08:15 UTC
Updated: 14 Aug 2026, 10:00 UTC
Resolved: 14 Aug 2026, 10:00 UTC

Description

Steps to reproduce

Upload Entra ID metadata during a certificate rollover (two KeyDescriptor use="signing").

Expected: both kept, as a depot config allows two since March. Actual: only the first.

Linked issues

relates to ENG-1328 Depot SAML config accepts two signing certificates during a rollover Done

Comments (1)

Hanna Virtanen · 14 Aug 2026, 10:00 UTC

Verified with Kelderby's test file and a rolled one.