Renewing the SSL certificate for ADFS (Active Directory Federation Services)

Renewing the SSL certificate for ADFS (Active Directory Federation Services)

Renewing the SSL certificate for ADFS (Active Directory Federation Services) 3.0 involves several key steps to ensure that your ADFS environment remains secure and functions properly after the certificate has been updated. Here's a detailed, step-by-step guide for renewing the SSL certificate in ADFS 3.0:

### **Step 1: Obtain a New SSL Certificate**

Before you can renew the SSL certificate, you need to obtain a new SSL certificate from a trusted Certificate Authority (CA). You can either renew your existing certificate or request a new one, depending on your requirements.

1. **Generate a Certificate Signing Request (CSR):**

   - Open the **ADFS Management** console.

   - Navigate to **Service** > **Certificates**.

   - Click on **Add Token-signing or Token-decrypting Certificate** and choose **Request Certificate**.

   - Generate the CSR and submit it to the Certificate Authority (CA).

   - The CA will provide the renewed certificate in the form of a `.cer` file or another format.

2. **Install the SSL Certificate:**

   - Once the new certificate is issued, install it on the ADFS server.

   - To install the certificate, double-click the `.cer` file and follow the prompts.

   - Ensure that the certificate is installed under the **Personal** store in the **Certificates** snap-in.

### **Step 2: Update the SSL Certificate in ADFS**

Once the certificate has been installed, you need to configure ADFS to use the new SSL certificate for secure communication.

1. **Open the ADFS Management Console:**

   - Go to **Start** > **Administrative Tools** > **AD FS Management**.

2. **Select the ADFS Server:**

   - In the ADFS Management console, navigate to **Service** > **Certificates**.

3. **Update the SSL Certificate:**

   - Under the **Service Communications** section, right-click on the existing **SSL certificate** and choose **Set as Primary**.

   - You will be prompted to select the new certificate that you installed earlier.

   - Choose the new certificate from the list, ensuring it has the correct expiration date.

4. **Verify the Updated Certificate:**

   - Ensure that the **Service Communications** section now lists the updated SSL certificate as the primary certificate.

   - Ensure the thumbprint of the new certificate matches the one you installed.

### **Step 3: Bind the New SSL Certificate to IIS (Internet Information Services)**

ADFS relies on IIS for secure communication, so you must bind the new certificate to the IIS website that handles ADFS requests.

1. **Open IIS Manager:**

   - Open **Internet Information Services (IIS) Manager**.

   - In the **Connections** pane, expand your server and click on **Sites** > **AD FS Web Proxy**.

2. **Edit Bindings:**

   - In the **Actions** pane, click on **Bindings**.

   - Under the **Site Bindings** window, find the HTTPS binding (port 443).

   - Click **Edit** and select the new SSL certificate from the drop-down list.

   - Click **OK** to apply the changes.

### **Step 4: Update the SSL Certificate for Web Application Proxy (WAP) (if applicable)**

If you are using a Web Application Proxy (WAP) in your environment to provide external access to ADFS, you also need to update the SSL certificate on the WAP servers.

1. **Log in to the WAP Server:**

   - Open **IIS Manager** on the Web Application Proxy server.

2. **Update SSL Binding:**

   - Follow the same steps you used on the ADFS server to update the SSL certificate for the WAP binding.

   - Open the **IIS Manager**, and under **Sites**, select the **AD FS Proxy** site.

   - Click **Bindings**, and update the HTTPS binding to use the new SSL certificate.

### **Step 5: Update the Federation Service Properties (Optional)**

If your federation service name or certificate changes, you may need to update the federation service properties.

1. **Open ADFS Management:**

   - In **ADFS Management**, go to **Service** > **Properties**.

2. **Update Federation Service Properties:**

   - If you are using a new federation service name (DNS), update the federation service properties accordingly.

   - Update the **SSL certificate** details under **Certificates** > **Service Communication** if required.

### **Step 6: Test the SSL Certificate Renewal**

After the certificate has been updated, it is important to test your ADFS service to ensure everything is functioning properly.

1. **Test Internal and External Access:**

   - Verify internal ADFS logins (to ensure that local users can authenticate).

   - Test external access (for external users connecting via WAP).

2. **Use Browser or ADFS Diagnostic Tools:**

   - Open a browser and navigate to your ADFS login page (`https://<ADFS-FQDN>/adfs/ls`).

   - Click the padlock icon in the address bar to verify the certificate details and expiration date.

3. **Check ADFS Event Logs:**

   - Check **Event Viewer** for any ADFS-related warnings or errors after the update.

   - Look for events related to **Service Communications** and **Certificate**.

### **Step 7: Cleanup Old Certificates**

After confirming that everything is working with the new SSL certificate, you should remove any old certificates that are no longer in use.

1. **Open the Certificates Snap-in:**

   - Type `certmgr.msc` in the Run dialog and press Enter.

   - In the Certificates window, go to **Personal** > **Certificates** and delete any expired or old certificates that were replaced during the renewal process.

### **Step 8: Document the Changes**

Ensure you document the renewal process and update any internal documentation regarding the certificate expiration date, the steps taken, and the new thumbprint for reference in case of future issues.

### Summary:

- Obtain a new SSL certificate from a trusted CA.

- Install and configure the SSL certificate in ADFS.

- Bind the new certificate in IIS.

- Update the certificate on the Web Application Proxy (if applicable).

- Verify and test that the ADFS service and external access are working.

- Clean up old certificates.

Following these steps will ensure that your ADFS environment remains secure and operational after the SSL certificate renewal.