rewindex

CompaniesKeeperIncidents

Keeper: SSO login errors with strict SP cert matching

No impact listedStatus: postmortemStarted Resolved (0 min)2 updatesstspg.io (opens in new tab)

Timeline of updates

  1. resolved

    Several customers have been experiencing SSO login errors this morning. The team determined the cause of the issue which is detailed in the postmortem report.

  2. postmortem

    On June 30, 2025, Keeper published an updated SAML Service Provider (SP) certificate as part of our standard annual process. This certificate is used for signing SP requests and does not impact SSL termination. During the update, the certificate subject name was unintentionally changed from sso.keepersecurity.com to sso.staging.keepersecurity.com.

    While most identity providers do not validate the certificate subject name, certain providers—such as JumpCloud and Shibboleth—may enforce strict matching and reject SAML requests when the subject name does not align.

    On Sunday July 6, 2025, routine backend infrastructure changes caused the cert to be propagated across production systems throughout the morning hours. The issue with the subject name was identified by our team after several troubleshooting calls with customers. The DevOps team then corrected the issue by publishing the certificate with the proper subject name around 12pm PST.

    After reviewing the case history, this affected a small number of customers. Next year, when the SP cert change is approaching, we will notify all customers with the exact date and time when the cert will be updated, so those customers using strict SP cert matching can be prepared. We apologize for the error and we have taken steps to ensure this does not occur again.

Archive proof

Rewindex commits each version of an incident it captures to a daily checkpoint, chains it to the day before, and has the checkpoint timestamped by FreeTSA and DigiCert. That proves this record existed by then and has not been changed since, by anyone, Rewindex included.

How the archive is checked, and what it cannot prove.

Impact, status and times are the vendor’s own, as last archived. View on stspg.io (opens in new tab).

Cite this

Status incident (vendor impact label: none) posted by Keeper, started 2025-07-06 15:00 UTC, resolved after 0 min, 2 update(s).

Title
SSO login errors with strict SP cert matching
Vendor
Keeper
Date
URL
https://rewindex.com/company/keeper/incidents/wgkry9jkksrw

Keeper profileRecent Keeper incidentsAll outages on July 6, 2025Keeper in July 2025MarkdownJSON