Support / SUP-1053
Brakeline: Hull, Leeds and Doncaster locked out after a certificate change
Description
Logged after the fact. Priya Nair rang at 06:20: "Hull early shift can't get in, error after the Microsoft page."
Brakeline's IT tested a scripted signing-certificate rollover on three depot apps in Entra ID and made the new certificates active at about 05:30 without sending them to us. Sign-ins refused ("The response was signed with an unknown certificate") at Hull from 05:50, Leeds 05:58, Doncaster 06:10: 143 failed sign-ins. New metadata loaded in the ops console at 08:05.
Comments (2)
Priya Nair · 24 Jul 2026, 13:10 UTC
Understood, that was our test going wrong. We'll do it that way.
Hi Priya, a summary of this morning: the three depots' new signing certificates were active in Entra ID before we had them, so we refused the sign-ins until we loaded them at 08:05. Next time: add the new certificate beside the old one, send us the metadata, and make it active once we confirm. That way nothing breaks.