Alright, hit a classic snag. Rotated the IdP's signing cert, now Appgate SDP just laughs at our SAML assertions. Logs show the dreaded "InvalidSignature" or "Could not validate signature."
Assuming you've already triple-checked the obvious (new cert uploaded to the SDP Controller, entity ID matches, binding correct). The devil's in the metadata and the reload.
First, force a metadata refresh on your gateways. The controller might have the new cert, but the gateways are caching the old IdP metadata.
SSH into a gateway and run:
```bash
appgate-service saml refresh
appgate-service restart
```
If that doesn't bite, check the IdP's metadata endpoint directly. Sometimes the `IDPSSODescriptor` KeyDescriptor still references the old cert's `use="signing"`. Might need to nuke the metadata cache on the Controller side or do a full provider re-import.
Also, verify the new cert's algorithm. If your IdP switched from RSA-SHA256 to something else, Appgate might be throwing a fit. Share a sanitized snippet of your provider config if you're still stuck.