diff --git a/src/flow.ts b/src/flow.ts
index 5c0db2bc..ac962237 100644
--- a/src/flow.ts
+++ b/src/flow.ts
@@ -241,8 +241,8 @@ async function postFlow(options: FlowOptions): Promise<FlowResult> {
     } else if (decryptRequired && !verified) {
       // Encrypted assertion, signature is on the assertion itself.
       const result = await libsaml.decryptAssertion(self, samlContent);
-      const decryptedDoc = result[0];
-      const [decryptedDocVerified, verifiedDecryptedAssertion] = libsaml.verifySignature(decryptedDoc, verificationOptions);
+      samlContent = result[0];
+      const [decryptedDocVerified, verifiedDecryptedAssertion] = libsaml.verifySignature(samlContent, verificationOptions);
       if (decryptedDocVerified) {
         extractorFields = getDefaultExtractorFields(parserType, verifiedDecryptedAssertion);
       } else {
diff --git a/src/libsaml.ts b/src/libsaml.ts
index c33269df..5719b5c2 100644
--- a/src/libsaml.ts
+++ b/src/libsaml.ts
@@ -642,8 +642,7 @@ const libSaml = () => {
         }
 
         sig.loadSignature(signatureNode);
-
-        verified = sig.checkSignature(doc.toString());
+        verified = sig.checkSignature(xml);
 
         if (!verified) {
           continue;
diff --git a/test/flow.ts b/test/flow.ts
index 3e578df8..c1b10d5d 100644
--- a/test/flow.ts
+++ b/test/flow.ts
@@ -430,6 +430,7 @@ test('send response with signed assertion and parse it', async () => {
   expect(typeof id).toBe('string');
   expect(samlContent.startsWith('<samlp:Response')).toBe(true);
   expect(samlContent.endsWith('/samlp:Response>')).toBe(true);
+  expect(samlContent).toContain('>user@esaml2.com</saml:NameID>')
   expect(extract.nameID).toBe('user@esaml2.com');
   expect(extract.response.inResponseTo).toBe('request_id');
 });
@@ -955,6 +956,7 @@ test('send login response with encrypted non-signed assertion and parse it', asy
   expect(typeof id).toBe('string');
   expect(samlContent.startsWith('<samlp:Response')).toBe(true);
   expect(samlContent.endsWith('/samlp:Response>')).toBe(true);
+  expect(samlContent).toContain('>user@esaml2.com</saml:NameID>')
   expect(extract.nameID).toBe('user@esaml2.com');
   expect(extract.response.inResponseTo).toBe('request_id');
 });
@@ -1133,6 +1135,7 @@ test('send login response with encrypted non-signed assertion with EncryptThenSi
   expect(typeof id).toBe('string');
   expect(samlContent.startsWith('<samlp:Response')).toBe(true);
   expect(samlContent.endsWith('/samlp:Response>')).toBe(true);
+  expect(samlContent).toContain('>user@esaml2.com</saml:NameID>')
   expect(extract.nameID).toBe('user@esaml2.com');
 });