I have been using the Saml2 library successfully for a while now but just realized I had hard coded the CertificateValidationMode to ‘None’

I set this to ChainTrust and am now getting an error that the cert for ADFS01.* has an untrusted Root.

Chain Status:'A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider.

My cert structure is like so, this is all handled by a Windows PKI infrastructure. Offline Root CA, Online Subordinate CA. Offline Root CA cert is trusted by all domain endpoints by installing RootCA cert in Trusted Root Certification Authorities:

RootCA -> IntermediateCA -> ADFS01.*

I am providing the cert to library like so:

saml2Configuration.SignatureValidationCertificates.Add(CertificateUtil.Load(StoreName.Root, StoreLocation.LocalMachine,
        X509FindType.FindByThumbprint, Configuration["Saml2:CertificateThumbprint"]));

The thumbprint is for the RootCA cert which is in the Trusted Root store of the Local Machine hosting the application.

What am I doing wrong? Shouldn’t the ADFS01 cert be trusted in the SAML flow since it’s trusted by the machine, and loaded as a SignatureValidationCertificate? I can browse to my ADFS logon page and it’s trusted.

Thanks!