Good question,
We have recently modified both the Identifier Entity ID & Reply URL to point to the new cisco client vpn name. However, the SMAL Certificate is still the same we haven't modify so it looks like its pointing to old the Entity ID & Reply URL that we initially configured, which now makes sense why it doesn't work, shall we removed the old SMAL Signing Certificate because its pointing to old vpn name, then updated the new SMAL Signing Certificate on the cloud.