Update the SSL certificate on each AD FS server. Obtain a publicly trusted SSL certificate with the following requirements. ...

Update the SSL certificate on each AD FS server.

  1. Obtain a publicly trusted SSL certificate with the following requirements.
    1. Certificate installation file contains its private key.
    2. Enhanced Key Usage is at least Server Authentication.
    3. Certificate Subject or Subject Alternative Name (SAN) contains the DNS name of the Federation Service or appropriate wild card. For example: sso.contoso.com or *.contoso.com
  2. Install the new SSL certificate on each server in the local machine certificate store.
  3. Ensure that the AD FS Service Account has read access to the certificate's Private Key

For AD FS 2.0 in Windows Server 2008R2:

  • Bind the new SSL certificate to the web site in IIS which hosts the Federation Service. Please note that you must perform this step on each Federation Server and Federation Server proxy.

For AD FS in Windows Server 2012 R2:

  • Run the following PowerShell Command: set-AdfsSSLCertificate -Thumbprint {new certificate thumbprint}
    For example: set-AdfsSSLCertificate -Thumbprint 7F92A390D1558C8A56D2E9999D22E7FF200374AC