RocketChat/Rocket.Chat · error · Error

Missing certificate while generating metadata for decrypting

Error message

Missing certificate while generating metadata for decrypting service provider

What it means

Error "Missing certificate while generating metadata for decrypting service provider" thrown in RocketChat/Rocket.Chat.

Source

Thrown at apps/meteor/server/lib/saml/lib/generators/ServiceProviderMetadata.ts:25

/*
	The metadata will be available at the following url:
	[rocketchat-url]/_saml/metadata/[provider-name]
*/

export class ServiceProviderMetadata {
	public static generate(serviceProviderOptions: IServiceProviderOptions): string {
		const data = this.getData(serviceProviderOptions);
		return SAMLUtils.fillTemplateData(this.metadataTemplate(serviceProviderOptions), data);
	}

	private static certificateTagTemplate(serviceProviderOptions: IServiceProviderOptions): string {
		if (!serviceProviderOptions.privateKey) {
			return '';
		}

		if (!serviceProviderOptions.privateCert) {
			throw new Error('Missing certificate while generating metadata for decrypting service provider');
		}

		return serviceProviderOptions.metadataCertificateTemplate || defaultMetadataCertificateTemplate;
	}

	private static metadataTemplate(serviceProviderOptions: IServiceProviderOptions): string {
		const data = {
			certificateTag: this.certificateTagTemplate(serviceProviderOptions),
		};

		const template = serviceProviderOptions.metadataTemplate || defaultMetadataTemplate;
		return SAMLUtils.fillTemplateData(template, data);
	}

	private static getData(serviceProviderOptions: IServiceProviderOptions): IMetadataVariables {
		if (!serviceProviderOptions.callbackUrl) {
			throw new Error('Unable to generate service provider metadata when callbackUrl option is not set');
		}

View on GitHub (pinned to b2c16d5842)

Solutions

  1. Upload/configure the decryption certificate (and private key) in the SAML service provider settings before generating metadata.

When it happens

Trigger: Thrown when generating service provider metadata with decryption enabled but no private key/certificate configured.

Common situations: See trigger scenarios.

Understand the failure class

AI-assisted analysis of RocketChat/Rocket.Chat@b2c16d5842 (2026-08-18). Data as JSON: /api/errors/3ff7f9a41ae09b24. Report an issue: GitHub.