title: Validating certificate trust chain on Azure website communicating with secure services
body: <p>We're having an intermittent issue with a azure website (ASP.NET MVC) that talks to a service that is secured by a security token service.</p>
  
  <p>This website is working fine 99% of the time, but it occasionally starts suffering this problem. Restarting the azure website normally resolves the issue, but then starts happening again an hour or so later.</p>
  
  <p>The error we're basically getting is:</p>
  
  <pre><code>System.IdentityModel.Tokens.SecurityTokenValidationException: ID4257: X.509 certificate '[cert info here]' validation failed by the token handler. 
  ---&gt; System.IdentityModel.Tokens.SecurityTokenValidationException: The X.509 certificate [cert info here] is not in the trusted people store. 
       The X.509 certificate [cert info here] chain building failed. The certificate that was used has a trust chain that cannot be verified. 
       Replace the certificate or change the certificateValidationMode. A certificate chain could not be built to a trusted root authority.
  
     at System.IdentityModel.Selectors.X509CertificateValidator.PeerOrChainTrustValidator.Validate(X509Certificate2 certificate)
     at Microsoft.IdentityModel.X509CertificateValidatorEx.Validate(X509Certificate2 certificate)
     at Microsoft.IdentityModel.Tokens.Saml11.Saml11SecurityTokenHandler.ValidateToken(SecurityToken token)
     --- End of inner exception stack trace ---
     at Microsoft.IdentityModel.Tokens.Saml11.Saml11SecurityTokenHandler.ValidateToken(SecurityToken token)
     at Microsoft.IdentityModel.Tokens.SecurityTokenHandlerCollection.ValidateToken(SecurityToken token)
  </code></pre>
  
  <p>The important thing to note here is that the certificate is definitely valid, with a valid trust chain, built to a standard trusted root authority, and we haven't changed anything!</p>