Resolving Atlassian Cloud certificate error for SAML SSO

Summary

This article covers how to resolve a certificate error when accessing an Atlassian cloud application through SAML SSO.

Diagnosis

How to identify the error

To verify and validate the certificate error, review the error specified within the URL query string as shown below:

access_denied&error_description=Invalid%20thumbprint

Cause

• This error occurs when an incorrect SAML certificate is updated on the Atlassian cloud SSO configuration.

  • The SAML configurations are located on the Atlassian cloud at Administration > Security > Identity providers (left navigation) > View SAML Configurations.

  • The Public certificate.

• This situation may arise during the configuration of SSO or when updating the SSO certificate on Atlassian Cloud.

Solution

Follow these steps to complete the task:

1. Access the Identity Provider (IdP) admin console.

2. Locate the Atlassian cloud application within the IdP.

3. Obtain the Base64 Certificate for the Atlassian cloud application.

4. Open the downloaded certificate in a text file and copy the entire certificate value from -----BEGIN CERTIFICATE----- to -----END CERTIFICATE-----.

5. Paste the certificate value into Atlassian cloud SSO configurations (Security > Identity providers > View SSO configurations).

Validation

1. Open an incognito or private window in your browser.

2. Navigate to https://id.atlassian.com.

3. Enter the user's email address and click on Continue.

4. Proceed with the IdP authentication process.

How to get a certificate within some supported IdPs

• Microsoft Entra (formerly Azure)

• Okta

• OneLogin

• JumpCloud