SharePoint 2016 Error : NotTimeValid: A required certificate is not within its validity period

Question

I am stumped on this error and need some insight/assistance in solving it.

I had a wildcard SSL cert issued by GoDaddy that expired and I removed and replaced the renewed cert on all SharePoint servers - * in IIS; * in Cert:\LocalMachine\Sharepoint; * in SharePoint SPTrustedRootAuthority * STS

... but I still get the following error:

---

Server Error in '/' Application.

NotTimeValid: A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file.

Description: An unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error and where it originated in the code.

Exception Details: System.IdentityModel.Tokens.SecurityTokenValidationException: NotTimeValid: A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file.

Source Error:

An unhandled exception was generated during the execution of the current web request. Information regarding the origin and location of the exception can be identified using the exception stack trace below.

Stack Trace:

[SecurityTokenValidationException: NotTimeValid: A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file. ] Microsoft.SharePoint.SPImmutableCertificateValidator.Validate(X509Certificate2 certificate) +556 Microsoft.SharePoint.SPCertificateValidator.Validate(X509Certificate2 certificate) +362 Microsoft.IdentityModel.Tokens.Saml11.Saml11SecurityTokenHandler.ValidateToken(SecurityToken token) +451

[SecurityTokenValidationException: ID4257: X.509 certificate 'CN=*.abcd.com, OU=Domain Control Validated' validation failed by the token handler.] Microsoft.IdentityModel.Tokens.Saml11.Saml11SecurityTokenHandler.ValidateToken(SecurityToken token) +1557 Microsoft.IdentityModel.Tokens.SecurityTokenHandlerCollection.ValidateToken(SecurityToken token) +127 Microsoft.SharePoint.IdentityModel.SPFederationAuthenticationModule.GetPrincipalFromToken(SecurityToken securityToken) +247 Microsoft.SharePoint.IdentityModel.SPFederationAuthenticationModule.AuthenticateUser(SecurityToken securityToken) +11 Microsoft.SharePoint.IdentityModel.SPFederationAuthenticationModule.SetPrincipalAndWriteSessionTokenWithOptions(SecurityToken securityToken, SPSessionTokenWriteType writeOperationType) +293 Microsoft.SharePoint.IdentityModel.<>c__DisplayClass5.b__1() +240 Microsoft.SharePoint.Utilities.SecurityContext.RunAsProcess(CodeToRunElevated secureCode) +194 Microsoft.SharePoint.IdentityModel.SPWindowsClaimsAuthenticationHttpModule.PerformClaimsAuthenticationForUser(HttpContext context, SPFederationAuthenticationModule fam, SessionAuthenticationModule sam, WindowsIdentity windowsIdentity, SessionSecurityToken sessionSecurityToken, Boolean writeCookie) +362 Microsoft.SharePoint.IdentityModel.SPWindowsClaimsAuthenticationHttpModule.AuthenticateRequest(Object sender, EventArgs e) +822 System.Web.SyncEventExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute() +229 System.Web.HttpApplication.ExecuteStepImpl(IExecutionStep step) +213 System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously) +91

Does anyone know how to resolve this?

Answer 1

It appears the SSL cert was also used for the Security Signing Service (STS) as well, So I used the PowerShell below and it worked:

Get-SPSecurityTokenServiceConfig

$path = 'C:\Certs\wildcard_abcd_com.pfx' $pass = 'P@$$W0rd'

Import-PfxCertificate -FilePath $path -CertStoreLocation Cert:\LocalMachine\Root Password $pass.Password

$cert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2($path, $pass, 20) Set-SPSecurityTokenServiceConfig -ImportSigningCertificate $cert

iisreset /restart

Restart-Service SPTimerV4

I hope this saves someone a few hours.

Cheers,

~G