You might see that the Dropbox Community team have been busy working on some major updates to the Community itself! So, here is some info on what’s changed, what’s staying the same and what you can expect from the Dropbox Community overall.
Forum Discussion
400 malformed_certificate google
My company uses SSO with Google and we recently began getting 400. Error: malformed_certificate. The SAML certificate had expired, I rotated a new one in and indicated that for Dropbox within Google Admin Console.
In their steps to update, the final one seems to be to configure DB to point to the new cert:
7. After changing the certificate assigned to the SAML app, make sure to also update the app's SSO configuration with the new certificate on the Service Provider's website. SSO with the SAML app won't work until the SP-side configuration is also updated.
Feels like I'm close to getting this to work again, but don't know exactly what the final bit is. Do I just need to wait to propagate, like a DNS server?
Thank you. This has been resolved, though the DB process made it difficult.
By way of answering my own question: I needed to go to DB Admin Console and upload the new certificate. The challenge was that the only way to get to the Admin Console was to login to DB. The only way to login in to DB was via SSO. It was an endless loop.
DB admins are supposed to be able to login using either SSO or with log/pass credentials (while everyone else is required to use SAML). I am listed as an admin *but did not have ability to login using credentials.* Another admin was able to login that way, disable the SAML-only restriction, so I could upload the cert. Recommend having two accounts with admin access, in case this happens to others.
- Jay
Dropbox Staff
Hi bryangarner-wd, thanks for bringing this to our attention.
I'd recommend getting in contact with the support team directly for them to investigate this matter in more detail.
They'll be able to assist further!
Thank you. This has been resolved, though the DB process made it difficult.
By way of answering my own question: I needed to go to DB Admin Console and upload the new certificate. The challenge was that the only way to get to the Admin Console was to login to DB. The only way to login in to DB was via SSO. It was an endless loop.
DB admins are supposed to be able to login using either SSO or with log/pass credentials (while everyone else is required to use SAML). I am listed as an admin *but did not have ability to login using credentials.* Another admin was able to login that way, disable the SAML-only restriction, so I could upload the cert. Recommend having two accounts with admin access, in case this happens to others.
