AD FS cannot find the certificate needed to validate the message or token signature EventCode=371

Question

Post a recent certificate renewal on my ADFS Fed and Proxy servers, we are observing the following failures in logs -

Cannot find certificate to validate message/token signature obtained from claims provider. Claims provider: http://identityserver.v2.thinktecture.com/samples

Reaching out to seek help to understand the RCA

Answer 1

@Vikas B Yadav
The error implies that the Claimsprovider trust on the ADFS is misconfigured.
Apparently the Claimsprovider is using a Token Signing Certificate to sign the tokens it issued
yet this Certificate has not been configured on the ADFS Claimsprovider trust

If you are by chance the Admin of the Claims Provider verify which certificate is configured for token signature
export the public key and import it on the ADFS
else ask the admin to provide you with the public key

If there is a online FederationMetadata.xml try to update the Claims Provider on the ADFS and see if the new certificate is imported

Capture a Trace (Fiddler/HAR traces) and decode the SamlToken, check for the signature and if it contains a KeyInfo Element
if it does you may be lucky finding the X509Certificate (containing the base64 encoded certificate) used by the TokenIssuer
when you save the base64encoded value to a file and save it as .cer you have the public key and can import it to the ADFS Claims Provider trust too