ADFS SSL Certificate Replacement: Updating Service Communication and Token Signing Certificates

Active Directory Federation Services (ADFS) is a security-sensitive component — it handles authentication tokens for applications like Office 365, SharePoint, and third-party SaaS. It uses multiple certificates: the SSL/TLS certificate for the service endpoint, the token-signing certificate, and the token-decryption certificate. This article focuses on replacing the SSL certificate used by the ADFS service endpoint, which must be renewed before it expires to prevent federation from breaking.

ADFS certificate types

ADFS manages three types of certificates, each with a different replacement procedure:

Certificate	Purpose	Typical source	Auto-renew
Service Communications (SSL)	HTTPS for the ADFS endpoint and federation metadata	Internal CA or public CA	No
Token-signing	Signs security tokens issued by ADFS	Self-managed by ADFS	Yes (automatic rollover)
Token-decryption	Decrypts encrypted tokens	Self-managed by ADFS	Yes (automatic rollover)

This article covers the Service Communications certificate — the one that shows up in browser certificate warnings and must cover fs.example.com, certauth.fs.example.com, and enterpriseregistration.example.com.

Certificate requirements for ADFS

The SSL certificate must cover these names (adjust for your domain):

• fs.example.com — the ADFS endpoint (or your chosen ADFS hostname)
• certauth.fs.example.com — used for certificate-based authentication
• enterpriseregistration.example.com — used for Workplace Join and Azure AD registration

All three should be in the SAN. The certificate can be a UCC/multi-SAN certificate or a wildcard (*.example.com) that covers all three.

Step 1: Obtain the new certificate

Request a certificate from your internal AD CS:

# On the ADFS server
$cert = Get-Certificate `
    -Template "WebServer" `
    -SubjectName "CN=fs.example.com" `
    -DnsName "fs.example.com", "certauth.fs.example.com", "enterpriseregistration.example.com" `
    -CertStoreLocation "Cert:\LocalMachine\My"

$thumb = $cert.Certificate.Thumbprint
Write-Host "New certificate thumbprint: $thumb"

Or import a PFX:

$pfxPassword = ConvertTo-SecureString -String "PFXpassword" -AsPlainText -Force
$cert = Import-PfxCertificate `
    -FilePath "C:\Certs\adfs.example.com.pfx" `
    -CertStoreLocation "Cert:\LocalMachine\My" `******

$thumb = $cert.Thumbprint

Step 2: Grant the ADFS service account access to the private key

The ADFS service account must have read access to the private key.

$thumb = "YOURNEWTHUMBPRINT"
$cert = Get-Item "Cert:\LocalMachine\My\$thumb"

# Find the private key file
$rsaKey = [System.Security.Cryptography.X509Certificates.RSACertificateExtensions]::GetRSAPrivateKey($cert)
$keyPath = [System.IO.Path]::Combine(
    $env:ALLUSERSPROFILE,
    "Microsoft\Crypto\RSA\MachineKeys",
    $rsaKey.Key.UniqueName
)

# Get the ADFS service account name
$adfsAccount = (Get-WmiObject Win32_Service -Filter "Name='ADFSSRV'").StartName

# Grant read access
$acl = Get-Acl $keyPath
$rule = New-Object System.Security.AccessControl.FileSystemAccessRule($adfsAccount, "Read", "Allow")
$acl.AddAccessRule($rule)
Set-Acl $keyPath $acl

Write-Host "Granted $adfsAccount read access to private key"

Step 3: Update the ADFS service communications certificate

Via ADFS Management Console

1. Open ADFS Management (adfs.msc).
2. Go to Service → Certificates.
3. In the right panel, click Set Service Communications Certificate.
4. A dialog shows available certificates in Cert:\LocalMachine\My.
5. Select the new certificate.
6. Click OK.

Via PowerShell

$thumb = "YOURNEWTHUMBPRINT"

# Set the new service communications certificate
Set-AdfsSslCertificate -Thumbprint $thumb

# Also set it as the service communications certificate in ADFS properties
Set-AdfsProperties -ServiceCertificateThumbprint $thumb

On ADFS 4.0 (Windows Server 2016+):

Set-AdfsSslCertificate -Thumbprint $thumb

# Verify
Get-AdfsSslCertificate

Step 4: Update the IIS binding on the ADFS server

ADFS uses IIS for the federation endpoint. Update the IIS SSL binding:

Import-Module WebAdministration

$thumb = "YOURNEWTHUMBPRINT"
$port = 443
$siteName = "Default Web Site"

# Remove old SSL binding
$binding = Get-WebBinding -Name $siteName -Protocol https
if ($binding) {
    Remove-WebBinding -Name $siteName -Protocol https -Port $port -HostHeader ""
}

# Create new binding
New-WebBinding -Name $siteName -Protocol https -Port $port -SslFlags 0

# Assign new certificate
$cert = Get-Item "Cert:\LocalMachine\My\$thumb"
$certPath = "IIS:\SslBindings\0.0.0.0!$port"
$cert | New-Item $certPath -Force

Write-Host "IIS binding updated"

Step 5: Restart the ADFS and IIS services

# Restart ADFS service
Restart-Service ADFSSRV
# Restart IIS
Restart-Service W3SVC

# Wait and check
Start-Sleep -Seconds 10
Get-Service ADFSSRV | Select-Object -Property Status

Step 6: Update Web Application Proxy (WAP) if deployed

If your environment uses Web Application Proxy (WAP) servers in front of ADFS:

# On each WAP server — install the new certificate
$pfxPassword = ConvertTo-SecureString -String "PFXpassword" -AsPlainText -Force
Import-PfxCertificate `
    -FilePath "\\share\adfs.example.com.pfx" `
    -CertStoreLocation "Cert:\LocalMachine\My" `******

# Update WAP to use the new certificate
$thumb = "YOURNEWTHUMBPRINT"
Set-WebApplicationProxySslCertificate -Thumbprint $thumb

# Restart WAP service
Restart-Service appproxysvc

Step 7: Verify the certificate replacement

From the ADFS server:

# Verify via ADFS PowerShell
Get-AdfsCertificate -CertificateType Service-Communications

# Verify via IIS binding
netsh http show sslcert ipport=0.0.0.0:443

From a client machine:

# Check the certificate being served at the ADFS endpoint
openssl s_client -connect fs.example.com:443 -servername fs.example.com </dev/null 2>&1 \
  | openssl x509 -noout -subject -dates

# Verify federation metadata is accessible
curl https://fs.example.com/federationmetadata/2007-06/federationmetadata.xml -o /dev/null -w "%{http_code}\n"
# Expected: 200

Step 8: Update Relying Party Trust (for custom SaaS apps)

Some relying party applications (those using certificate pinning or explicit certificate validation) need to be updated after a certificate change. Check with each application vendor.

For Azure AD / Entra ID, the service endpoint metadata auto-updates because Azure reads from the federation metadata URL. However, if you changed the token-signing certificate (not covered here), you would need to run:

Update-MsolFederatedDomain -DomainName example.com

Common ADFS certificate issues

“The Federation Service could not find a certificate matching the specified thumbprint”

This means the private key access was not granted to the ADFS service account. Repeat Step 2.

“ADFS SSL certificate has expired” in Event Viewer

Events 270 and 385 in the ADFS/Admin event log indicate certificate issues. Run:

Get-EventLog -LogName "AD FS/Admin" -Newest 20 | Where-Object {$_.EventID -in @(270, 385, 387, 391)} | Select-Object -Property TimeGenerated, EventID, Message

Certificate not visible in ADFS Management Console

The certificate must be in Cert:\LocalMachine\My — not CurrentUser. Verify:

Get-ChildItem "Cert:\LocalMachine\My" | Where-Object {$_.Subject -like "*fs.example.com*"} | Select-Object -Property Subject, Thumbprint, NotAfter

Token-signing certificate confusion

Token-signing certificates are separate from SSL certificates. ADFS manages them automatically with automatic rollover. Do not manually replace token-signing certificates unless there is a specific reason — automatic rollover is safer.

ADFS certificate monitoring

Check certificate expiry in a scheduled script:

# Check all ADFS certificate types
Get-AdfsCertificate | ForEach-Object {
    $daysLeft = ($_.Certificate.NotAfter - (Get-Date)).Days
    [PSCustomObject]@{
        Type        = $_.CertificateType
        Subject     = $_.Certificate.Subject
        NotAfter    = $_.Certificate.NotAfter
        DaysLeft    = $daysLeft
        NeedsRenewal = ($daysLeft -lt 30)
    }
} | Format-Table

Summary

ADFS SSL certificate replacement has three components: update the ADFS service communications certificate with Set-AdfsSslCertificate, update the IIS SSL binding for port 443, and if WAP servers are deployed, update them with Set-WebApplicationProxySslCertificate. Before making any change, grant the ADFS service account read access to the new certificate’s private key. Restart both ADFSSRV and W3SVC after the update. Token-signing and token-decryption certificates should be left to ADFS automatic rollover — do not confuse them with the SSL certificate.