ADFS Logout - No signature verification certificate found for issuer

Steps to reproduce

1.Configure ADFS Relying party and NC to work for SAML via user_saml app
2. Login works great
3. Logout gives error message from ADFS SLO and in event viewer of ADFS with these errors:
https://ibb.co/nngzMmP
https://ibb.co/ncX17SJ
https://ibb.co/wwgqn7g

Expected behaviour

Tell us what should happen
ADFS Successful logout message

Actual behaviour

Tell us what happens instead
https://kloudprdwpblog.azureedge.net/wp-content/uploads/2015/07/2015-07-15-adfs-error-01.jpg

Server configuration

Operating system: CentOS 7

Web server: Apache (HTTPD on default CentOS repos)

Database: MariaDB

PHP version: 7.2.10

Nextcloud version: (see Nextcloud admin page): 16.0.3

Where did you install Nextcloud from: nextcloud website, extracting to web server

List of activated apps:

Brute-force settings 1.3.0
Accessibility 1.2.0
Activity 2.9.1
Collaborative tags 1.6.0
Comments 1.6.0
Deleted files 1.6.0
Federation 1.6.0
File sharing 1.8.0
First run wizard 2.5.0
Gallery 18.3.0
Log Reader 2.1.0
Monitoring 1.6.0
Nextcloud announcements 1.5.0
Notifications 2.4.1
Password policy 1.6.0
PDF viewer 1.5.0
Privacy 1.0.0
Recommendations 0.4.0
Right click 0.13.0
Share by mail 1.6.0
SSO & SAML authentication 2.3.1
Support 1.0.0
Text editor 2.8.0
Theming 1.7.0
Update notification 1.6.0
Usage survey 1.4.0
Versions 1.9.0
Video player 1.5.0
Viewer 1.0.0
Auditing / Logging 1.6.0
Default encryption module 2.4.0
External storage support 1.7.0
LDAP user and group backend 1.6.0
If you have access to your command line run e.g.:
sudo -u www-data php occ app:list
from within your Nextcloud installation folder

### Client configuration
**Browser:** Edge Chromium, Firefox, Internet Explorer, Chrome

**Operating system:** Windows 10

### Logs

#### Nextcloud log (data/owncloud.log)

no errors during this

Browser only does the ADFS error page



Set up public cert for Service Provider (Cert+Key) and signing cert for IDP.

Enabled:
Indicates whether the <samlp:AuthnRequest> messages sent by this SP will be signed. [Metadata of the SP will offer this info]
Indicates whether the <samlp:logoutRequest> messages sent by this SP will be signed.
Indicates whether the <samlp:logoutResponse> messages sent by this SP will be signed.
Whether the metadata should be signed.
Indicates a requirement for the <saml:Assertion> elements received by this SP to be signed. [Metadata of the SP will offer this info]
Indicates a requirement for the <saml:Assertion> elements received by this SP to be encrypted.
Indicates a requirement for the NameID element on the SAMLResponse received by this SP to be present. 
Indicates if the SP will validate all received XML.
ADFS URL-Encodes SAML data as lowercase, and the toolkit by default uses uppercase. Enable for ADFS compatibility on signature verification. 

Start by reproducing the SAML logout flow with the reported ADFS relying-party configuration and the enabled signing and signature-verification settings. Compare the ADFS SLO error and event-viewer messages with the user_saml configuration; done means ADFS completes logout successfully without the certificate error.