In today’s article, I’ll explain how to generate and update the SSL certificate on AD FS using Microsoft Entra Connect and update the service communication certificate using the AD FS console.
What is the SSL Certificate used for?
SSL (Secure Sockets Layer) certificates are used by AD FS for secure information traffic through Web services using SSL communication with clients and proxy servers. It’s recommended to use certificates issued by public certificate authorities so that clients external to the organization don’t receive certificate warning messages when accessing applications managed by AD FS.
Generating the SSL certificate
For this test, we’ll generate a certificate for the domain ulyneves.com using DigiCert. If you have a subscription with this certificate authority, follow the steps below:
1 – In the DigiCert Center, select Certificates.
2 – Select Orders.
3 – Select Request a certificate.
4 – Click GeoTrust Cloud DV.
To generate the CSR code with the certificate information, download the Digicert Certificate Utility application and follow the steps in this link.
With the code generated, we confirm the Common Name of the configured domain and its validity.
We’ll select DNS TXT as the way to prove domain ownership.
Select the payment method and click Submit certificate request.
With the request submitted, we need to prove ownership of the domain, which shows a status of “Pending”, as shown below. Let’s click Prove Control Over Domains. Follow the steps to create the TXT record in the external DNS responsible for the domain.
With the TXT record created in the external DNS, domain control is confirmed and the certificate can be issued.
With the certificate issued, we’ll use the Digicert Certificate Utility application to export the certificate.
1 – Open the application and select the SSL menu.
2 – Select the certificate for the intended domain.
3 – Click Export Certificate.
We’ll export the certificate’s private key by selecting the Yes, export the private key option, as shown below.
Click Next.
We’ll enter a password to protect the private key and click Next.
We’ll select the location where the certificate will be saved and click Finish.
Changing the SSL certificate on AD FS
The easiest and recommended way to update SSL certificates on AD FS is by using Microsoft Entra Connect.
Open the Microsoft Entra Connect console and click Configure.
Select the Manage federation menu and click Next.
Select the Manage certificates option and click Next.
Select the Update SSL certificate option and click Next.
We’ll enter the credential with administrative permission on the servers that will receive the SSL certificate. In this case, all servers that make up the AD FS farm. Then, click Next.
Confirm the AD FS servers that are part of the farm and click Next.
Confirm the WAP servers that are part of the farm and click Next.
Now let’s select the new SSL certificate generated in the previous steps by clicking Browse.
Select the certificate and click Open.
Enter the password configured during the certificate export process and click OK.
With the certificate properly configured, click Next.
Confirm the servers that will receive the new SSL certificate and click Next.
Confirm the certificate update by clicking Configure.
With the confirmation below that the configuration was completed successfully, click Exit.
What is the service communication certificate used for?
The service communication certificate is used for authentication between servers that host the federation services and for internal communication between them. By default, the SSL certificate is also used to ensure secure internal communication between the servers.
How to configure the service communication certificate
To change the service communication certificate, follow the steps below:
1 – In the AD FS console, select the Certificates option.
2 – In the Actions window, select Set Service Communications Certificate.
In the configuration window, select the certificate you want to use and click Open.
Summary
In today’s article, we covered how to generate an SSL certificate through DigiCert, update the AD FS farm with the new certificate using Microsoft Entra Connect, and how to change the service communication certificate using the AD FS console.
I hope this content has helped enrich your knowledge of AD FS.
Did you like the post? Like and share it. 🙂
If you have any suggestions or comments, let us know.
[ ]’s
Ulysses Neves
