Memorise

Change / Update / Replace SSL Certificate on Windows Server 2012 R2 ADFS / WAP Servers

Change/Update/Replace SSL Certificate on Windows Server 2012 R2 ADFS/WAP Servers

You need a cert that has a private key that corresponds to the certificate. If you don’t make sure that you export the PFX and be sure to include the private key. It’s easy to miss this in the export wizard.

After you have the certificate imported into the ADFS Servers “Personal Store” then you need to make sure that you assign the appropriate permissions to the certificate. Specifically, you need to assign full control to the ADFS service account.

Now you’ll want to bounce over to the ADFS Console to “Set Service Communications Certificate”

You can do this via PowerShell as well:

Run Get-AdfsSslCertificate. Make a note of the thumbprint of the new certificate.

Set-AdfsCertificate -CertificateType Service-Communications -Thumbprint thumbprint

Set-AdfsSslCertificate -Thumbprint thumbprint

—
i.e:
Set-AdfsCertificate -CertificateType Service-Communications -Thumbprint DDEFDF4A73F48AD079B2C1BCBC60610863A3A7C9

Set-AdfsSslCertificate -Thumbprint DDEFDF4A73F48AD079B2C1BCBC60610863A3A7C9
—

Restart the ADFS Service (restart-service adfssrv)

—

if you get error with certificate don’t have private key use the certutil to repair

C:UsersAdministrator>certutil -repairstore my “77 f0 55 c4 4d 01 db 18”

you should see message like CertUtil: -repairstore command completed successfully. C:UsersAdministrator>

— Full GUI version —

You need a cert that has a private key that corresponds to the certificate.  If you don’t make sure that you export the PFX and be sure to include the private key.  It’s easy to miss this in the export wizard.

When you walk through the export wizard – make sure you choose the option to include the private key.

After you have the certificate imported into the ADFS Servers “Personal Store” then you need to make sure that you assign the appropriate permissions to the certificate.  Specifically, you need to assign full control to the ADFS service account.  If you are using a managed service account be sure to scope your search for that when assigning permissions.

Now you’ll want to bounce over to the ADFS Console to “Set Service Communications Certificate”

You can do this via PowerShell as well:

Set-AdfsCertificate -CertificateType Service-Communications -Thumbprint thumbprint
Set-AdfsSslCertificate -Thumbprint thumbprint

You’ll see all the certs in the personal store enumerated – be sure to pick the right one (there is an option to view the cert before selecting it).  If you don’t see your cert it means you didn’t import it correctly or there’s no private key that corresponds to the cert.

Now you need to open PowerShell to run a few commands.

Run Get-AdfsSslCertificate.  Make a note of the thumbprint of the new certificate.

WARNING!!!

You might run into what I did which is what was messing me up and prompted me to author this article.  For some reason for me when I issue the Get-AdfsSslCertificate command it still showed my OLD certificate – not the new one that I just updated with the set service communication certificate step above.  You’ll need to confirm this by going into the certificate store and looking at the details of the certificate you set to be the service communication cert to see if the thumbprint there matches what you see with the GET command.  In my case, it didn’t match.

At this point you want to take that hex and paste it out to notepad and then remove all of the spaces and then when you issue the SET command make sure to paste that value for the CORRECT certificate in as the thumbprint.

Next run Set-AdfsSslCertification –thumbprint XXXXXXXXXXXXXXXXXXXXXX

Restart the ADFS Service (restart-service adfssrv)

The Powershell for all of this (including installing the role/feature) is:

Install-WebApplicationProxy -FederationServiceTrustCredential System.Management.Automation.PSCredential -CertificateThumbprint ‘thumbprintwiththequotes’ -FederationServiceName ‘adfs.getmobile.mobi’

OPTIONAL: Using a Web Application Proxy Server

Now if you are using a Web Application Proxy Server in front of your ADFS Server you need to do a few things.

I used the MMC console to see the certificate store on my ADFS server to export the PFX with the private key (make sure you do that!) so that I could import that key over on my WAP server.  Once you have that PFX just copy it over to the WAP and click on it – make sure that you import it into the PERSONAL STORE.  You can then open the MMC console to see the certificates there and make sure that it has been imported properly to the WAP.

Now at this point you should be able to run a PS command to replace the SSL cert and then restart the adfssrv on the WAP and you’re good to go.  For whatever reason that didn’t work for me so I just removed/reinstalled the WAP feature.  If you already have published web applications those won’t go away.  When you reinstall the WAP feature you’ll see your list of published apps show back up.  Basically, just walk through the wizard setup for the WAP again and then select the certificate we’ve been talking about from the list when the setup asks you.  That worked like a charm for me.

You can try the PowerShell commands here – hopefully they work for you:

Set-WebApplicationProxySslCertificate -Thumbprint thumbprint (the thumbprint is the same as the one we used above so you should be able to just copy and paste.  If you want to get it again you can issue the GET instead of the SET to see the thumbprints for the certs)

You’ll need to restart the service on the WAP:  Restart-Service adfssrv

Tagged with:

Categorised as: Microsoft, Networking, Server OS, Windows Upgrade