---
title: "SSO certificate expired site errors"
slug: "29-sso-certificate-expired-site-errors"
updated: 2026-11-02T18:41:05Z
published: 2026-11-02T18:34:09Z
canonical: "docs.thebigpos.com/29-sso-certificate-expired-site-errors"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.thebigpos.com/llms.txt
> Use this file to discover all available pages before exploring further.

# SSO certificate expired site errors

A borrower cannot reach the sign-in page, or reaches it and cannot get through. They have tried several devices, browsers, and networks and cleared their cache, and nothing helps. It usually affects everyone at a company rather than one person.

## The symptom set

Any of these, and more than one of them at once is the giveaway:

- **502 Bad Gateway**
- **504**
- A white screen with an error code on it
- **"Cannot authenticate, please contact your lender"**
- A blank e-sign window reported by several borrowers at the same lender

The last one matters because it is easily mistaken for a borrower problem. Several borrowers at one lender with a blank e-sign window is this. One borrower with a blank window is something else — see article 48 for the consent step and article 03 for a genuinely absent package.

## This is almost always an expired certificate

The single sign-on connection between the POS and Encompass depends on a certificate issued by ICE Mortgage Technology. When it expires the connection stops and borrowers get these errors. Nothing is wrong with the borrower's account or with the loan file.

## What it takes to fix, and who does it

Support supplies the updated metadata XML. Applying it is your own side's job: your company's Encompass super-admin applies the updated metadata XML in the ICE developer portal. Support cannot do this part and cannot do it for you. It is a short task, but it needs that admin access — worth identifying who holds it before you need them.

## Worth knowing

Encompass does not warn before this certificate expires. The first sign is usually borrowers reporting they cannot sign in, and it has surfaced over a weekend more than once.

## When to contact support

Report it as soon as one borrower describes a gateway error on more than one network, or as soon as a second borrower at the same lender reports a blank e-sign window. Say that other devices and networks were already tried — that rules out the borrower's side immediately and gets you to the real cause faster.