Fix Malformed_Certificate SAML Sign-In Error After Certificate Renewal
Question details
Users cannot sign in to Microsoft via Google Workspace SSO due to a SAML2 Malformed_certificate error following a Google identity provider certificate renewal.
- Product
- Microsoft Entra ID / Google Workspace SSO
- Device & OS
- not provided
- Scenario
- Attempting to sign in using Single Sign-On (SSO) after updating an expired Google Workspace identity provider certificate.
- Observed behavior
- A Malformed_certificate error blocks access to the tenant, and administrators are locked out because the Microsoft tenant still relies on the old certificate.
Ensure you have the login credentials for a break-glass (emergency access) account that bypasses SSO to manage your Microsoft tenant configurations.
Update the Identity Provider Certificate in Microsoft Entra
Manually update the federated domain configuration in Microsoft Entra with the newly generated Google Workspace certificate.
When a SAML certificate is renewed on the Identity Provider (Google Workspace), the Service Provider (Microsoft Entra) must be updated to match. A mismatch results in a Malformed_certificate error.
Log in to the Microsoft Entra admin center using a break-glass Global Administrator account (usually an @onmicrosoft.com account) that does not require SSO.
Go to Azure Active Directory, select Enterprise applications or Federated domains depending on your setup.
Replace the old certificate by uploading the new Identity Provider (IdP) metadata XML or SAML certificate generated from the Google Admin console.
Save the new configuration, open an incognito browser window, and test the SSO sign-in process to confirm the error is resolved.
Recover Access via Microsoft Support
If no break-glass admin accounts are available and all admins are locked out, contact Microsoft Support to regain tenant access.
Experience a Seamless Office Alternative with WPS Office
While troubleshooting complex Microsoft tenant and SSO issues, keep your productivity uninterrupted with WPS Office. It provides a lightweight, highly compatible alternative to Microsoft Office that is completely free.
Frequently Asked Questions
What causes a Malformed_certificate error in SAML SSO?
This error usually occurs when the identity provider's SAML certificate expires or is renewed, but the service provider (like Microsoft Entra) still holds the old certificate. This creates a mismatch that breaks the trust relationship.
What is a break-glass account?
A break-glass account is an emergency, highly privileged administrator account (e.g., admin@yourdomain.onmicrosoft.com) that does not rely on SSO or conditional access policies, ensuring you can still access your tenant if SSO fails.
How do I get my new certificate from Google Workspace?
You can download the new Identity Provider (IdP) metadata or certificate directly from the Google Admin console under the Apps > Web and mobile apps > SAML apps configuration section.
Can I share my tenant information on support forums to get help faster?
No. You should never post your account credentials, tenant IDs, or SAML certificates publicly. Always use secure private messaging or official authenticated support channels to protect your organization's security.
