Issue in updating nonce certificate for SPSE version 26H2

Hi Quan,

Thank you for reaching out and sharing the details of the nonce certificate update on your SharePoint Server Subscription Edition 26H2 farm.

This behavior usually occurs because the update method completes silently without applying any change when the certificate is not managed by SharePoint Certificate Management or when the farm has not been fully upgraded.

Below are some workarounds that suit your situation:

1/ Confirm the farm upgrade status

Run the command below and make sure no server shows NeedsUpgrade = True. If any server does, run the SharePoint Products Configuration Wizard on that server first.

   Get-SPServer | ? Role -ne Invalid | select Name, Status, NeedsUpgrade

2/ Import the certificate into SharePoint Certificate Management

The method requires a certificate object returned by Get-SPCertificate, not one taken from the Windows certificate store.

   $pwd = Read-Host -AsSecureString "PFX password"
   $nonceCert = Import-SPCertificate -Path "C:\certs\nonce.pfx" -Password $pwd -Store EndEntity -Exportable

If the certificate is already imported, use $nonceCert = Get-SPCertificate -Thumbprint "<thumbprint>" and confirm that it returns exactly one certificate.

3/ Apply the certificate again

   $farm = Get-SPFarm
   $farm.UpdateNonceCertificate($nonceCert, $true)

4/ Verify the result in a new SharePoint Management Shell window

The farm object is cached in the current session, so the change may not show there. Also note that NonceCertificate may not be a property name on the farm object; checking a name that does not exist returns an empty value without any error. Please use:

   $f = Get-SPFarm
   $f | Get-Member *nonce*
   $f.Properties['SP-NonceCookieCertificateThumbprint']

5/ Check the SharePoint Timer Service

Make sure it is running on all servers so the certificate can be deployed across the farm.

If the value is still empty after these steps, please send us the output of steps 1 and 4, together with the ULS logs collected while running the command. You can collect the logs with:

Merge-SPLogFile -Path C:\temp\nonce.log -StartTime (Get-Date).AddMinutes(-10)

For your information, you can refer to:

• Set up OIDC authentication in SharePoint Server with Microsoft Entra ID
• The nonce cookie certificate is not managed by Certificate Management
• OpenID Connect 1.0 authentication in SharePoint Server

If the nonce certificate value is still empty after these steps, please share the upgrade status of your servers, the verification result from step 4, and the ULS logs collected while running the update. With this information, I can review the issue further and advise you on the next steps.

I hope this information helps. If you have any questions or concerns, please let me know, and I'll be happy to assist further.

Kind regards.