How to Replace SSL Certificate on ADFS Server (Windows Server 2025)

Start by importing your new SSL certificate with private key to the Local Machine Personal certificate store on every ADFS and WAP server in your farm.

Open the Microsoft Management Console on each server:

mmc.exe

Add the Certificates snap-in: File > Add/Remove Snap-ins > Certificates > Add > Computer account > Local computer > Finish > OK.

Navigate to Certificates (Local Computer) > Personal > Certificates. Right-click in the empty space and select All Tasks > Import. Follow the Certificate Import Wizard:

• Select your certificate file (.pfx or .p12)
• Enter the private key password
• Choose "Local Machine" as the store location
• Select "Personal" as the certificate store

Verify the import by checking the certificate appears in the Personal store with a key icon indicating the private key is present.

# Verify certificate import via PowerShell
Get-ChildItem -Path Cert:\LocalMachine\My | Where-Object {$_.Subject -like "*your-domain.com*"}

The ADFS service account needs read access to the private key of your new certificate. This is critical for the service to use the certificate.

In the Certificates MMC, right-click your new certificate and select All Tasks > Manage Private Keys. Click Add to open the user selection dialog.

For Group Managed Service Accounts (gMSA), click Object Types and check "Service Accounts". Enter your ADFS service account name (typically ends with $):

DOMAIN\ADFS-Service$

Grant the following permissions:

• Read
• Full Control (recommended for troubleshooting)

Click OK to apply the permissions.

Verify permissions using PowerShell:

# Check certificate private key permissions
$cert = Get-ChildItem -Path Cert:\LocalMachine\My | Where-Object {$_.Thumbprint -eq "YOUR_CERT_THUMBPRINT"}
$cert.PrivateKey

Before updating the SSL certificate, you may want to update the Service Communications certificate through the ADFS Management console. This step is optional but recommended for consistency.

Open ADFS Management from Server Manager > Tools > AD FS Management. Navigate to Service > Certificates in the left panel.

Right-click on "Service Communications" and select "Set Service Communications Certificate". Choose your new certificate from the list and click OK.

# Alternative: Update via PowerShell
Set-AdfsCertificate -CertificateType Service-Communications -Thumbprint "YOUR_CERT_THUMBPRINT"

This updates the certificate used for service-to-service communications within the ADFS farm.

Verify the update:

Get-AdfsCertificate -CertificateType Service-Communications

You need the exact thumbprint of your new certificate to configure it as the SSL certificate. The thumbprint is a unique identifier for the certificate.

Retrieve the current SSL certificate information and note the thumbprint format:

Get-AdfsSslCertificate

Find your new certificate's thumbprint:

# List all certificates in Personal store with thumbprints
Get-ChildItem -Path Cert:\LocalMachine\My | Select-Object Subject, Thumbprint, NotAfter | Format-Table -AutoSize

Copy the thumbprint of your new certificate. Make sure to remove any spaces or hidden characters:

# Get specific certificate thumbprint
$newCert = Get-ChildItem -Path Cert:\LocalMachine\My | Where-Object {$_.Subject -like "*your-domain.com*" -and $_.NotAfter -gt (Get-Date)}
$thumbprint = $newCert.Thumbprint
Write-Host "Certificate Thumbprint: $thumbprint"

Verify the thumbprint is correct by checking the certificate details in the MMC console.

Run the SSL certificate update command on the primary ADFS server. Since Windows Server 2016, this command automatically propagates the change to all servers in the farm.

Execute the following command on the primary ADFS server:

# Replace YOUR_CERT_THUMBPRINT with your actual thumbprint
Set-AdfsSslCertificate -Thumbprint "YOUR_CERT_THUMBPRINT"

The command should complete without errors. If successful, you'll see a confirmation message.

Restart the ADFS service to ensure the new certificate is properly loaded:

Restart-Service adfssrv

Wait for the service to fully restart before proceeding:

# Check service status
Get-Service adfssrv

Verify the SSL certificate update:

Get-AdfsSslCertificate

Web Application Proxy servers require separate certificate updates. Import the certificate to each WAP server first, then update the configuration.

On each WAP server, set the new SSL certificate:

# Update WAP SSL certificate
Set-WebApplicationProxySslCertificate -Thumbprint "YOUR_CERT_THUMBPRINT"

If the above command fails, you may need to reconfigure the WAP with the new certificate:

# Get ADFS farm credentials
$cred = Get-Credential

# Reinstall WAP with new certificate
Install-WebApplicationProxy -FederationServiceName "adfs.yourdomain.com" -FederationServiceTrustCredential $cred -CertificateThumbprint "YOUR_CERT_THUMBPRINT"

Update the IIS binding manually on each WAP server. Open IIS Manager, navigate to Sites > Default Web Site, and click Bindings. Edit the HTTPS binding (port 443) and select your new certificate.

Verify the WAP configuration:

Get-WebApplicationProxySslCertificate

While the Set-AdfsSslCertificate command propagates to all farm members, you should restart the ADFS service on secondary servers to ensure they pick up the new certificate binding.

On each secondary ADFS server, restart the service:

Restart-Service adfssrv

Monitor the service restart:

# Wait for service to start
do {
    Start-Sleep -Seconds 5
    $service = Get-Service adfssrv
    Write-Host "Service Status: $($service.Status)"
} while ($service.Status -ne "Running")

Check the Windows Event Log for any certificate-related errors:

# Check ADFS Admin event log for errors
Get-WinEvent -LogName "AD FS/Admin" -MaxEvents 10 | Where-Object {$_.LevelDisplayName -eq "Error"}

Verify each server is using the new certificate:

Get-AdfsSslCertificate | Select-Object PortNumber, CertificateHash

Perform comprehensive testing to ensure the new SSL certificate is working correctly across all ADFS endpoints and services.

Test the ADFS sign-in page in a web browser:

https://adfs.yourdomain.com/adfs/ls/IdpInitiatedSignOn.aspx

Verify there are no certificate warnings or errors. The browser should show a valid SSL connection with your new certificate.

Test from PowerShell using Invoke-WebRequest:

# Test ADFS metadata endpoint
$response = Invoke-WebRequest -Uri "https://adfs.yourdomain.com/FederationMetadata/2007-06/FederationMetadata.xml" -UseBasicParsing
Write-Host "Status Code: $($response.StatusCode)"

Check certificate details programmatically:

# Verify certificate via HTTPS connection
$request = [System.Net.WebRequest]::Create("https://adfs.yourdomain.com")
$request.GetResponse().Close()
$cert = $request.ServicePoint.Certificate
Write-Host "Certificate Subject: $($cert.Subject)"
Write-Host "Certificate Expiry: $($cert.GetExpirationDateString())"

Test authentication with a test user account to ensure the authentication flow works end-to-end.

Monitor ADFS event logs for the next 24 hours to catch any delayed issues:

Get-WinEvent -LogName "AD FS/Admin" -MaxEvents 50 | Where-Object {$_.TimeCreated -gt (Get-Date).AddHours(-1)}