Vossberg: Okta sign-ins refused at every depot after their certificate rotation

Project: Operations
Type: Incident
Status: Done Done
Priority: Medium
Organization: Vossberg Logistik
Reporter: Oskar Lund <oskar.lund@acme-hq.example>
Assignee: Oskar Lund <oskar.lund@acme-hq.example>
Labels: sev3vossbergoktasingle-sign-on
Components: identity-service
Created: 10 Oct 2026, 06:30 UTC
Updated: 10 Oct 2026, 07:45 UTC
Resolved: 10 Oct 2026, 07:45 UTC

Description

Summary

Vossberg rotated the signing certificate in Okta on Saturday morning without uploading new metadata to us. Each depot's single sign-on setup on our side still held the old certificate, so we refused every Okta sign-in from 08.00 to 09.30. Fixed by Vossberg switching Okta back to the previous certificate (SUP-1223).

Impact

Every Vossberg depot; about 1,100 failed attempts. People already signed in kept working. Graded SEV3: one customer, Saturday, a fix in their hands.

Timeline (Saturday 10 October)

08.00 First "signature not valid" refusals.
08.12 Vossberg's ticket, marked urgent.
08.24 Oskar (on call): fastest fix is to switch Okta back to the previous certificate, then move every depot together on a weekday.
08.41 Matthias starts reverting in Okta.
09.31 Sign-ins work again at Kassel and Hamm.

Why

With one setup per depot, a customer's certificate rotation means an upload for every depot: 60 for Vossberg, 32 for Parcelwise in August. One setup per customer is part of ACM-293.

Follow-up

The rotation, depot by depot: OPS-49.

Linked issues

relates to SUP-1223 Vossberg: Okta sign-in refused at every depot after certificate rotation Done
relates to OPS-49 Vossberg: move all 60 depots to the new Okta certificate, Wednesday 06:00–08:00 Done

Comments (0)

No comments.