Moving from AzureCP to EntraCP, certificate chain issue

[mattgudites]

I removed all traces of "AzureCP" that I could find, installed and configured EntraCP (the troubleshooting page shows that it is connecting successfully to our tenant), and I don't see any related certificates listed in the Manager Trust area in Central Admin. I'm completely stumped as to how to get rid of this error. I'm sifting through logs but not coming up with much.

I'm assuming this is related to Azure/EntraCP?

[Yvand]

@mattgudites I can assure you this error is absolutely not caused by EntraCP or AzureCP.
Basically, what SharePoint tells you is that the imcoming SAML token is not signed by the same signing certificate which you set in the SPTrust

[mattgudites]

I have no signing certs in the "Manage Trust" area. I've been troubleshooting this for a day; it's baffling. I can't find a trace of this certificate anywhere.

[Yvand]

In fact I read the error too fast: What you need to do is to add the whole certificate chain (intermediates + root certificates) to the SharePoint config:

New-SPTrustedRootAuthority -Name "parentOfSigningCertName" -Certificate $parentOfSigningCert