I am using Sitecore 9.1 and have recently updated my .pfx identity server certificates in Azure, due to the old ones expiring. After updating the Sitecore.IdentityServer.Host.xml configuration, the identity server issues JWTs with the correct kid. However, when I call my Sitecore API from Postman with a new JWT in the authorization header, Sitecore logs the following error:

ERROR Microsoft.Owin.Security.OAuth.OAuthBearerAuthenticationMiddleware - Authentication failed

Exception: Microsoft.IdentityModel.Tokens.SecurityTokenInvalidSignatureException

Message: IDX10500: Signature validation failed. No security keys were provided to validate the signature.

Source: System.IdentityModel.Tokens.Jwt at System.IdentityModel.Tokens.Jwt.JwtSecurityTokenHandler.ValidateSignature(String token, TokenValidationParameters validationParameters)

at System.IdentityModel.Tokens.Jwt.JwtSecurityTokenHandler.ValidateToken(String token, TokenValidationParameters validationParameters, SecurityToken& validatedToken)

at Microsoft.Owin.Security.Jwt.JwtFormat.Unprotect(String protectedText)

at Microsoft.Owin.Security.OAuth.OAuthBearerAuthenticationHandler.d__0.MoveNext()

The new certificate has been correctly imported on Sitecore app service, so I'm thinking perhaps I need to update some configuration value somewhere. However, the only configuration values I can seem to find are in App_Config\ConnectionStrings.config where some of the xconnect connection strings contain the thumbprint of the old certificate. Are there any configurations I need to update with the thumbprint of my new certificate or something else I am missing?

  • Possibly related and/or same issue. sitecore.stackexchange.com/questions/15711/…
    – Mark Cassidy
    Sep 24, 2020 at 7:54
  • @MarkCassidy I don't think it's the same issue. I already do what the solution in the linked issue suggests (using the correct grant_type and using the token as a bearer token in my requests from Postman. It used to work just fine. My issue started after attempting to use a new identity server certificate
    – csb
    Sep 24, 2020 at 9:12

1 Answer 1


We have had exact same issue and our scenario was similar

  1. We were using actual certificates and we found out that for internal roles we could user self signed certificates and hence we generated self signed certificate
  2. Updated its signature in all config file including the one above which you showed "Sitecore.IdentityServer.Host.xml"
  3. After restarting all instance, we were getting "Exception: Error occured" while login into CM and in logs we were getting those JWT token logs
  4. Using postman it was working just fine and giving us the token so issue was not with that
  5. We found out that identity server is not working with self signed certificate and it needs the actual certificate so we reverted that change for identity server and restarted apps

and everything started working for us, so basically for us it was the identity server and self signed certificate issue

Hope it helps

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.