This is possible only when certificate coming in SAML Response does not match with the certificate configured in the plugin. Copy the certificate value shown in the Test Configuration window and paste it in X.509 Certificate field in Service Provider tab in the plugin.