Windows Server 2012 R2 – Renew ADFS Certificate

adfsssl-certificatewindows-server-2012-r2

I'm trying to replace the certificate on ADFS. I've got wildcart certificate *.abc.pl, following by these steps:

  1. Log onto the ADFS server – done
  2. Add the new certificate to the server. Make sure this is added to the personal certificate store for the computer account. I usually do this using the certificates snap-in in MMC – done
    3.Find the thumbprint for the new certificate. This can be found by looking at the details for the certificate; the thumbprint is usually at/near the bottom of the list of details for the certificate and consists of 40 hexadecimal characters. Take a copy of the thumbprint and ensure that the spaces are removed, so it’s a 40 character string; you’ll need this in a few moments – done
    I had problems with import PFX generated by OpenSSL 3, password didnt match when I tried to import the certificate. The workaround was to generate the certificate by this command
    openssl pkcs12 -export -certpbe PBE-SHA1-3DES -keypbe PBE-SHA1-3DES -nomac -inkey privatekey2024.key -in cer2024.cer -export -out cer2024_2016.pfx

4.Grant the service account that is running the ‘Active Directory Federation Services’ service read access to the private key. To do this, follow these steps:
Within the certificates snap-in of MMC, right click the certificate, select ‘All Tasks’ and then select ‘Manage Private Keys…’: Manage private keys
Manage private keys
Click ‘Add…’ to add the user account running the ADFS service on the server and grant read access to that user. Click OK on the permissions dialog to close it.
Launch AD FS Management, expand ‘Service’ within the left pane and click ‘Certificates’: AF FS Manager Certificates
AF FS Manager Certificates – done
5. Click ‘Set Service Communications Certificate…’ from the actions panel at the right of the screen: Set Services Communication Cert
Set Services Communication Cert
A dialog is shown presenting the available certificates on the server. Select the new certificate that is to be used. If you are unsure of the correct certificate, select each certificate in turn and click the ‘Click here to view certificate properties’ link which is shown and compare the thumbprint with that recorded earlier. Click OK on the dialog once the correct certificate is selected.
If at this point you restart the server or ADFS service and make a connection to ADFS, you will still be presented with the original certificate. The change in the GUI changes the configuration in the ADFS configuration database, but not the certificate bound to HTTP.sys.

  1. To complete the configuration change, the following PowerShell command must be run: Set-AdfsSslCertificate –Thumbprint 00112233445566778899aabbccddeeff00112233 Where 00112233445566778899aabbccddeeff00112233 should be replaced with the thumbprint you found earlier.

And here I have a problem:
Get-ChildItem Cert:\LocalMachine\My

When i run the command
$newThumbprint = "01329a975bc181abb65aca0e22ddc9b72c766cc5" #thumbprint taken from *.abc.pl

Set-AdfsSslCertificate -Thumbprint $newThumbprintS

I've got error:

Set-AdfsSslCertificate : The certificate represented by thumbprint D65A9C243FFEB836ECB939ECC28F9E72BD982871 could not be found in the Target Computer Personal certificate store.  Check the thumbprint value and ensure that the desired certificate is installed in the Local Computer Personal certificate store.
At line:1 char:1
+ Set-AdfsSslCertificate -Thumbprint $newThumbprint
    + CategoryInfo          : InvalidArgument: (:) [Set-AdfsSslCertificate], DisplayableArgumentException
    + FullyQualifiedErrorId : The certificate represented by thumbprint D65A9C243FFEB836ECB939ECC28F9E72BD982871 could not be found in the Target Computer Personal c 
   ertificate store.  Check the thumbprint value and ensure that the desired certificate is installed in the Local Computer Personal certificate store.,Microsoft.Id  
  entityServer.Management.Commands.SetSslCertificateCommand

I didnt find the cert with that thumbprint, dont know what to do next :/

Best Answer

So I found this thumbprint via netsh http show sslcert (but still stuck)
enter image description here

Edit: how to delete problematic bindings: powershell (admin)

→netsh http show sslcert
http delete sslcert hostnameport=www.contoso.com:443

after that, command
AdfsSslCertificate –Thumbprint 00112233445566778899aabbccddeeff00112233
worked without error