AD FS contains multiple signing certificates in the XML, but only one can be specified for the plugin.

[tanakakz-alpha]

When updating the signing certificate, AD FS temporarily includes multiple certificates in the XML. The added certificate becomes Primary after 5 days have elapsed since it was created and is actually used by AD FS. This will happen automatically around 11 or 23 o'clock. However, since only one signing certificate can be specified for the plug-in, it is necessary to change the setting according to the timing when AD FS is updated.