Symptom
After renewing the TLS certificate on a self-managed Cribl Stream Leader, Microsoft Entra ID SAML SSO stops working: the SSO option disappears from the login page and only local login remains.
Cribl logs on the Leader show errors similar to:
Error: Unparsed DER bytes remain after ASN.1 parsing
Login failed: An unexpected error has occurred. Please check the logs for more info: Error: Unparsed DER bytes remain after ASN.1 parsing.
The stack trace points to SAML login request construction (for example, getPublicKeyPemFromCertificate, constructSAMLSignature, and base64LoginRequest).
Environment
- Cribl Stream, self-managed Leader node with SAML SSO enabled
- Microsoft Entra ID configured as the SAML identity provider
- Request certificate configured in Settings → Global → Authentication using an ECDSA certificate (for example, the same certificate used for TLS and provided as a full chain)
Resolution
-
Confirm the symptom in logs.
-
On the Cribl Stream Leader, review cribl.log around the failed login time and verify the SAML login request error that includes Unparsed DER bytes remain after ASN.1 parsing.
-
-
Locate the SAML Request certificate setting in Cribl Stream.
-
In the Cribl Stream UI, navigate to Settings → Global → Authentication.
-
In the SAML configuration section, find the Request certificate field (the certificate Cribl uses to sign SAML AuthnRequests toward Entra ID).
-
-
Remove any configured Request certificate for this Entra ID integration.
-
If the Request certificate field is populated (especially with the same certificate used for TLS or with a fullchain/ECDSA certificate), clear the field so it is empty.
-
Save the authentication configuration.
-
This disables request signing for the Entra ID SAML integration and, in this case, restores the SAML login flow.
-
-
Retest SSO login.
-
From the Cribl login page, confirm that the SSO option for Microsoft Entra ID is visible again.
-
Attempt an SSO login and verify that authentication succeeds without the Unparsed DER bytes remain after ASN.1 parsing error in the logs.
-
Cause
This can be caused by:
- Configuring the SAML Request certificate in Cribl Stream to use an ECDSA certificate which, in this case, caused Microsoft Entra ID to reject signed SAML login requests after the TLS certificate was changed, resulting in Unparsed DER bytes remain after ASN.1 parsing when Cribl attempted to build the AuthnRequest.
- Providing certificate material in the Request certificate field that the underlying SAML library cannot parse cleanly (for example, a full certificate chain or non-PEM encoding), which leads the DER/ASN.1 parser to report trailing unparsed bytes and prevents the SAML login request from being constructed.
Removing the unnecessary Request certificate entry for this Entra ID integration allowed Cribl Stream to build and send the SAML login request successfully, restoring SSO functionality.
Additional Information
- For full configuration guidance and supported patterns for Microsoft Entra ID SAML with Cribl Stream (on-prem), see the Cribl documentation for SSO with Microsoft Entra ID (on-prem).
- For Cribl.Cloud SSO scenarios, refer to SSO with Microsoft Entra ID (Cloud) and to the broader SSO initial setup documentation for group mapping and permissions. These pages describe how Cribl uses SAML attributes and when request signing and response validation certificates are required.