diff --git a/src/flow.ts b/src/flow.ts
index f58a5360..a2ffb2bd 100644
--- a/src/flow.ts
+++ b/src/flow.ts
@@ -211,7 +211,7 @@ async function postFlow(options): Promise<FlowResult> {
     checkSignature &&
     from.entitySetting.messageSigningOrder === MessageSignatureOrder.ETS
   ) {
-    const [verified, verifiedAssertionNode] = libsaml.verifySignature(samlContent, verificationOptions);
+    const [verified, verifiedAssertionNode] = libsaml.verifySignature(samlContent, verificationOptions, decryptRequired);
     if (!verified) {
       return Promise.reject('ERR_FAIL_TO_VERIFY_ETS_SIGNATURE');
     }
diff --git a/src/libsaml.ts b/src/libsaml.ts
index aa9691a4..9cf6ccf8 100644
--- a/src/libsaml.ts
+++ b/src/libsaml.ts
@@ -366,7 +366,7 @@ const libSaml = () => {
      *   - The first element is `true` if the signature is valid, `false` otherwise.
      *   - The second element is the cryptographically authenticated assertion node as a string, or `null` if not found.
      */
-    verifySignature(xml: string, opts: SignatureVerifierOptions) {
+    verifySignature(xml: string, opts: SignatureVerifierOptions, isAssertionEncrypted: boolean = false) {
       const { dom } = getContext();
       const doc = dom.parseFromString(xml);
 
@@ -485,6 +485,9 @@ const libSaml = () => {
           // now we can process the assertion as an assertion
           if (assertions.length === 1) {
             return [true, assertions[0].toString()];
+          } else if (isAssertionEncrypted) {
+            // if the assertions are encrypted there will be no 'Assertion' nodes
+            return [true, null];
           }
         } else if (rootNode.localName === 'Assertion') {
           return [true, rootNode.toString()];