Replace the AD FS SSL Certificate (PowerShell)

AD FS uses HTTP.sys rather than an IIS website for its TLS endpoints. Modern AD FS versions manage those bindings through AD FS PowerShell cmdlets. The TLS certificate is also distinct from token-signing and token-decrypting certificates; replacing one does not imply replacing the others.

Before you beginCopy Anchor Link

• Obtain a PFX with its private key, Server Authentication EKU, and the federation service name in the SAN. Include certauth.<federation-service-name> when the farm uses alternate TLS client binding mode.
• Record Get-AdfsProperties, Get-AdfsFarmInformation, Get-AdfsSslCertificate, the old thumbprint, and WAP servers.
• Have local administrative access to every federation and Web Application Proxy node.
• Back up AD FS configuration and schedule a rolling maintenance window. Keep at least one healthy node in the load-balancer pool.

Understand AD FS certificate rolesCopy Anchor Link

The TLS/SSL certificate protects HTTPS endpoints and is changed with Set-AdfsSslCertificate or, for alternate client TLS binding mode, Set-AdfsAlternateTlsClientBinding. The service communications certificate shown in AD FS Management is metadata for service communications and is not the HTTP.sys binding. Token-signing and token-decrypting certificates protect tokens and require a federation-partner rollover plan; they should not be changed during an ordinary TLS renewal.

AD FS commonly binds the federation service name on 443, localhost on 443, device registration names, and a client-certificate authentication endpoint. Default binding mode uses a non-443 client-authentication port such as 49443. Alternate mode uses certauth.<name> on 443 with SNI.

Step-by-step certificate replacementCopy Anchor Link

1. On every AD FS and WAP server, import the PFX into Cert:\LocalMachine\My:

   Copy Text

   $password = Read-Host "PFX password" -AsSecureString
   $cert = Import-PfxCertificate -FilePath C:\secure\adfs.pfx `
     -CertStoreLocation Cert:\LocalMachine\My -Password $password
   $thumbprint = $cert.Thumbprint
   Get-Item "Cert:\LocalMachine\My\$thumbprint" |
     Format-List Subject,DnsNameList,EnhancedKeyUsageList,HasPrivateKey,NotAfter

2. Identify the farm before choosing a cmdlet:

   Copy Text

   Get-AdfsSslCertificate                       # current bindings
   Get-AdfsSyncProperties | Format-List Role    # PrimaryComputer = primary server
   Get-AdfsFarmInformation | Format-List CurrentFarmBehavior

   • Binding mode: a binding for certauth.<federation-service-name> on port 443 means alternate TLS client binding mode (step 4); a binding on port 49443 means the default mode (step 3).
   • Farm behavior level: 3 is Windows Server 2016, 4 is Windows Server 2019 and later. Step 3's farm-wide update needs at least 3, run on the primary server.

3. On a Windows Server 2016-or-newer primary federation server at 2016 farm behavior level, update default binding mode once:

   Copy Text

   Set-AdfsSslCertificate -Thumbprint $thumbprint

   This is a multi-node cmdlet and uses PowerShell remoting to update the farm. TCP 5985 must be reachable from the primary to the other nodes. On Windows Server 2012 R2, run Set-AdfsSslCertificate on each federation server instead.

4. If the farm uses alternate TLS client binding mode, use the corresponding farm cmdlet rather than the default-mode command:

   Copy Text

   Set-AdfsAlternateTlsClientBinding -Thumbprint $thumbprint

5. After the AD FS farm, on each WAP server, run:

   Copy Text

   Set-WebApplicationProxySslCertificate -Thumbprint $thumbprint

   If an already expired trust prevents this, Microsoft documents rebuilding the WAP trust with Install-WebApplicationProxy and the federation service name.

6. Verify private-key access. On Server 2016+ the AD FS TLS cmdlets grant the adfssrv service principal read access to the key, so an additional ACL for the configured domain service account is not normally needed for the TLS binding. On older builds, custom certificate roles, or after a manual import/binding workflow, confirm the running identity can read the key. Find it with:

   Copy Text

   Get-CimInstance Win32_Service -Filter "Name='adfssrv'" |
     Select-Object Name,StartName,State

   In certlm.msc, use All Tasks > Manage Private Keys and grant only Read if the documented version and role require it. A certificate can appear bound yet fail when AD FS tries to use an inaccessible private key.

7. Check on each AD FS server whether every binding now carries the new certificate:

   Copy Text

   netsh http show sslcert

   Every AD FS entry should show the new thumbprint as Certificate Hash. If it does, no restart is needed. If a node still shows the old one, take it out of the load balancer and restart AD FS on that node only:

   Copy Text

   Restart-Service adfssrv

   Never restart the whole farm at once.

HTTP.sys and legacy proceduresCopy Anchor Link

Use HTTP.sys commands to inspect, not routinely replace, bindings on current AD FS:

netsh http show sslcert
Get-AdfsSslCertificate

Older AD FS documentation sometimes instructs administrators to delete and add netsh http bindings with an AppID. Direct editing is appropriate only for the AD FS version and binding mode whose Microsoft procedure explicitly calls for it. On modern farms, bypassing Set-AdfsSslCertificate can miss localhost, device registration, client-authentication, SNI, or other farm bindings and may not propagate to peers.

Product-specific considerationsCopy Anchor Link

For Server 2016+ multi-node updates, the primary federation server must itself be Server 2016 or newer and the farm behavior level must support the feature. Verify every node, even though the command runs once. Server 2012 R2 remains a per-node operation.

WAP certificates are local and require the WAP cmdlet on each proxy. Use the same certificate across AD FS and WAP unless the design and Microsoft requirements support separate names. Do not replace token-signing/decrypting certificates as a side effect; their rollover affects relying parties and claims providers.

Verify the new certificateCopy Anchor Link

Get-AdfsSslCertificate | Format-Table HostName,PortNumber,CertificateHash
netsh http show sslcert
Get-Service adfssrv

From outside the farm, verify both the TLS endpoint and application response:

openssl s_client -connect fs.example.com:443 -servername fs.example.com -showcerts
curl -fsS https://fs.example.com/FederationMetadata/2007-06/FederationMetadata.xml

Test sign-in, device/client certificate authentication when used, the WAP-published endpoint, and every node directly. Confirm the federation metadata still contains the expected token certificates; the TLS change should not silently alter them.

RollbackCopy Anchor Link

Use the old thumbprint you recorded with the same cmdlets - first the farm, then each WAP:

Set-AdfsSslCertificate -Thumbprint <old-thumbprint>        # or Set-AdfsAlternateTlsClientBinding
Set-WebApplicationProxySslCertificate -Thumbprint <old-thumbprint>   # on each WAP

Check the bindings as in step 7, and re-test metadata and sign-in. This only works while the old certificate is still installed and valid - keep it until all farm and proxy endpoints are confirmed.

Common problemsCopy Anchor Link

• The certificate is in Current User rather than Local Computer, or lacks a private key.
• The federation service or certauth name is missing from SANs.
• A Server 2016+ farm command cannot reach peers over PowerShell remoting.
• WAP nodes were not updated after the AD FS farm.
• An administrator changes only one netsh binding and leaves other AD FS bindings stale.
• A TLS renewal is confused with service-communications or token-certificate rollover.

Automating certificate replacement with aethercertCopy Anchor Link

The aethercert AD FS target imports the certificate, can grant a configured service identity read access to its private key, and invokes Set-AdfsSslCertificate for its service-communications selection or Set-AdfsCertificate for token signing and token decrypting. Microsoft distinguishes the farm's TLS/SSL binding from the service communications certificate shown in AD FS Management, so confirm that the selected mode matches the certificate you intend to replace. Farm mode, WAP scope, and token-certificate rollover impact still require deliberate administrative planning.

See Deploy targets for the fields this preset takes, what it needs on the host, and how far it has been verified.

SourcesCopy Anchor Link

• Microsoft Learn: manage TLS/SSL certificates in AD FS and WAP
• Microsoft Learn: Set-AdfsSslCertificate
• Microsoft Learn: Get-AdfsSslCertificate
• Microsoft Learn: service communications certificate distinction