title: WIF: "ID1014: The signature is not valid. The data may have been tampered with" Error when using non-store certificate
body: <p>When developing a claim-based authentication application, in order to make the application working when deployed to load balancing servers, I followed <a href="http://msdn.microsoft.com/en-us/library/ff803371.aspx" rel="nofollow noreferrer">http://msdn.microsoft.com/en-us/library/ff803371.aspx</a> to replace the default SecurityTokenHandler by using a RsaTokenTransform handler to encrypt the session cookies using a self-provided certificate:</p>
  
  <pre><code>X509Certificate2 serviceCertificate = new X509Certificate2(certificate, certificatePassword);
  List&lt;CookieTransform&gt; sessionTransformers =
      new List&lt;CookieTransform&gt;
      (
              new CookieTransform[]
          {
              new DeflateCookieTransform(),
              new RsaEncryptionCookieTransform(serviceCertificate),
              new RsaSignatureCookieTransform(serviceCertificate)
          }
      );
  SessionSecurityTokenHandler sessionHandler = new SessionSecurityTokenHandler(sessionTransformers.AsReadOnly());
  
  FederatedAuthentication.ServiceConfiguration.SecurityTokenHandlers.AddOrReplace(sessionHandler);
  </code></pre>
  
  <p><em>To make the application more flexible and portable, the certificate is pulled from a database and stored in a X509Certificate2 object at runtime.</em></p>
  
  <p>This is working with one server hosting the application but once I switched to a server farm, every now and then I got the error:</p>
  
  <p><strong>ID1014: The signature is not valid. The data may have been tampered with</strong></p>
  
  <p>Also some javascript, css and font files failed to load because of the same issue.</p>
  
  <p>Related questions but did not solve the issue:</p>
  
  <p><a href="https://stackoverflow.com/questions/10780729/wif-id1014-the-signature-is-not-valid-the-data-may-have-been-tampered-with">WIF- ID1014: The signature is not valid. The data may have been tampered with</a></p>
  
  <p><a href="https://stackoverflow.com/questions/15252663/wif-id1014-the-signature-is-not-valid-the-data-may-have-been-tampered-with">WIF: ID1014: The signature is not valid. The data may have been tampered with</a></p>