I was also experiencing this issue after upgrading from Splunk 6.5.0 to 7.0.0. I did have cert_1.pem and cert_2.pem files sitting in $SPLUNK_HOME/etc/auth/idpCerts prior to and after the upgrade. It seems that when the MSI runs an in place upgrade it may not be able to account for the new idpCertChain_1 storage location. Simply moving the files to this location did not correct the problem. It wasn't until I worked with support and went through the whole process of setting up SAML again that the issue was corrected by putting the root CA cert and the AD FS token signing cert in the IdP certificate chains free text box of the SAML configuration page. Once we did this, Splunk rebuilt the cert_1.pem and cert_2.pem files inside of the new $SPLUNK_HOME/etc/auth/idpCerts/idpCertChain_1 folder and it started working correctly. ... View more