AADSTS700027: The certificate with identifier used to sign the client assertion is not registered on application. [Reason - The key was not found

Question

AADSTS700027: The certificate with identifier used to sign the client assertion is not registered on application. [Reason - The key was not found

AWD Capture 0

Trying to generate client assertion by using the Base64 value of the thumbprint as x5t to generate the token . But I receive AADSTS700027: The certificate with identifier used to sign the client assertion is not registered on application. [Reason - The key was not found., Thumbprint of key used by client: 'xxx'

DavidAS 0 Reputation points

2025-03-21T23:57:14.2566667+00:00

I had this issue and the problem was the format of the x5t parameter, I had to convert the thumbprint to base64 as explained here: https://learn.microsoft.com/en-us/answers/questions/915775/aadsts700027-the-certificate-with-identifier-used

2 answers

Your answer

DavidAS 0 Reputation points

2025-03-21T23:57:14.2566667+00:00

I had this issue and the problem was the format of the x5t parameter, I had to convert the thumbprint to base64 as explained here: https://learn.microsoft.com/en-us/answers/questions/915775/aadsts700027-the-certificate-with-identifier-used

Answer 1

Idan Mor 15 Microsoft Employee

I had the same issue and I fixed it by adding "trustedCertificateSubjects" to the "App registration" Manifest.

"trustedCertificateSubjects": [
		{
			"authorityId": "00000000-0000-0000-0000-000000000001",
			"subjectName": "XXX.XXXXXXXXXXXX.aad.XXXXXX.XX"
		}
	]

You should update the "subjectName" with your certificate "Subject" (the value after the CN=) or with the "Subject Alternative Name". The certificate should be in your KeyVault.
User's image

Adam 15 Reputation points

2023-08-25T17:47:22.1466667+00:00

Where do I take these values from?

I mean authorityId and subjectName
Caz 0 Reputation points

2023-09-05T04:03:23.95+00:00

Also wondering where we take these values from? This info is unfortunately useless without us knowing please.
Ahmad Masalha 0 Reputation points Microsoft Employee

2023-10-04T19:51:39.45+00:00

I added this SNI pair to my app's manifest, yet I still encounter this error. Any insights?
Sean Kelly 5 Reputation points

2024-01-22T00:14:07.69+00:00

Where do you get the values from?
Vince Asta 0 Reputation points

2024-02-19T18:03:30.9866667+00:00

@Idan Mor Yes, also wondering if you can share where these values are coming from, please?
Idan Mor 15 Reputation points Microsoft Employee

2024-02-19T22:56:24.21+00:00
You should paste this at the end of the json object in the manifest file.
The only update should be the "subjectName" with your certificate "Subject" (the value after the CN=) or with the "Subject Alternative Name". The certificate should be in your KeyVault.

"trustedCertificateSubjects": [ { "authorityId": "00000000-0000-0000-0000-000000000001", "subjectName": "XXX.XXXXXXXXXXXX.aad.XXXXXX.XX" } ]

Answer 2

Shivam Dhiman 6,081

Hi @AWD Capture

As per the Azure AD error codes, AADSTS700027 describes "Client assertion failed signature validation". Developer error - the app is attempting to sign in without the necessary or correct authentication parameters. the certificate used to sign the assertion was not found in your application. Please ensure it has been added and that you're not targeting a certificate bound to a service principal from another tenant (for multi-tenant applications). You can review and upload your application certificates trough the Azure Portal.

Hope this helps.

If the answer is helpful, please click Accept Answer and kindly upvote. If you have any further questions about this answer, please click Comment.

Barbara Zujewska 0 Reputation points

2023-05-10T15:56:49.42+00:00

I have the exact same issue, but the certificate with a thumbprint matching the one used by the client is uploaded to the Azure AD through the portal. I tried importing the full .cer file and just the public key in .pem. It makes no difference.
Is it possible that the issue is caused by the certificate being self-signed (generated in Azure Key Vault)?
Ahmad Masalha 0 Reputation points Microsoft Employee

2023-10-04T19:53:14.72+00:00

I added the SNI pair to the app's manifest, all values were validated, yet I still encounter this issue. Any Insights?

Share via

AADSTS700027: The certificate with identifier used to sign the client assertion is not registered on application. [Reason - The key was not found

2 answers

Your answer