F5 as SP - Sign Authentication Request

Hello,

 

With F5 APM setup as SP, every time we try to enable Edit SAML SP Service -> Security Settings, thick box "Sign Authentication Request" - APM policy ends up with error "Invalid Nonce". What are the requirements for the certificate we are supposed to use and why is it allowed to even select any certificate?

 

Thank you