How to replace expiring Service Communication Certificates in ADFS 2.0

adfsfederatedmicrosoft-dynamics-crmssl-certificate

We have an ADFS 2.0 deployment which is used to provide claims-based authentication to our Dynamics CRM 2011 system. There are 2 ADFS servers in place. One is in the corporate user Active Directory domain while the other is in the secured production Active Directory domain (to which the deployed CRM servers belong).

The certificates which are being replaced are used for Service Communications in ADFS. Are there any special steps that should be completed to replace the expiring certificates?

Best Answer

Good write up here:

AD FS 2.0: How to Replace the SSL, Service Communications, Token-Signing, and Token-Decrypting Certificates.

Related Solutions

Using ADFS 2.0 for Google apps single sign on

I have got this working - Google Apps Single Sign-on, ADFS and a custom STS (although you could easily use Windows Auth or some other STS downstream, it doesn't affect the Google/ADFS configuration).

I have documented the steps required on my blog:

http://www.huggill.com/2012/01/12/setting-up-google-apps-single-sign-on-sso-with-adfs-2-0-and-a-custom-sts-such-as-identityserver/

Bind ADFS 2.0 service to a specific IP address

I'm making the assumption that Dynamics has its own website and does not use the default website. This may be totally incorrect.

Either way, if they are separate sites why don't you simply setup HTTPS Host Headers and ensure the default site and the dynamics site are both specifically assigned or bound to a certain host header or IP. You can always assign multiple IPs to the same NIC on the machine.

IIS SSL Host Header Command:

appcmd set site /site.name:"Name of Website in IIS" /+bindings.[protocol='https',bindingInformation='*:443:Host Header']

Best Answer

Related Solutions

Using ADFS 2.0 for Google apps single sign on

Bind ADFS 2.0 service to a specific IP address

Related Topic