38 C
Monday, July 22, 2024

Renewing ADFS Token Signing Certificate

Token signing certificates are standard X509 certificates that are used to securely sign all tokens that the federation server issues. Token decryption certificates are standard X509 certificates that are used to decrypt any incoming tokens. They are also published in federation metadata. Single Sign-on breaks if it expires. In my case, it’s used for several single sign-on Apps like Zscaler / Cisco Jabber. Let’s see how to Extend them to 1 year to 3 years and renew the same and update in zscaler.

ADFS Signing Certificate – Certificates


Let’s Extend the duration from 365 to 1095 days which is 3 years

Get-AdfsProperties | fl *cer*
Set-AdfsProperties -CertificateDuration 1095
Update-AdfsCertificate -CertificateType Token-Decrypting -urgent
Update-AdfsCertificate -CertificateType Token-Decrypting -urgent

Certificates are renewed now.

  • Token-Decrypting Certificate
  • Token-Signing Certificate

If you wish to disable auto certificate rollover  (let’s not do it. Just FYI )

Set-ADFSProperties -AutoCertificateRollover $false

Replacing SSL Certificate – Set Service Communication Certificate to new one.

Open MMC and Open Certificate Console of Local Machine and go to new certificate and managed private keys. Copy the same permission the old certificate had the service account in my case it was adfs admin and ran

Set-AdfsSslCertificate -Thumbprint "xxxxx"

it added drs and adfssrv permission on private keys

Renewing ADFS Proxy Certificate –

Get-WebApplicationProxyApplication | Fl *cer*,*id*
Get-Pfxcertificate c:\cert.pfx

Use above command to gain thumbprint value

Set-WebApplicationProxyApplication -ExternalCertificateThumbprint "xxx" -ID "xxx"

In my case, I need to use this in my Zscaler Forward proxy. Let’s see how to convert to PEM and use it.

Right Click on ADFS Signing Certificate

Copy to File

Choose Base-64 encoded X.509 (.CER)


Use a test Linux server or anything that has open SSL.


Took the file out via WinSCP


Update on Authentication Settings – Administrator Management –


Administration – Authentication Settings.


Satheshwaran Manoharan
Satheshwaran Manoharanhttps://www.azure365pro.com
Award-winning Technology Leader with a wealth of experience running large teams and diversified industry exposure in cloud computing. From shipping lines to rolling stocks.In-depth expertise in driving cloud adoption strategies and modernizing systems to cloud native. Specialized in Microsoft Cloud, DevOps, and Microsoft 365 Stack and conducted numerous successful projects worldwide. Also, Acting as a Technical Advisor for various start-ups.

Related Articles


  1. i did not used the key “urgent”.
    I used the command like “Update-ADFSCertificate -CertificateType token-signing” —-which results a secondary certificate has been created.

    how to i make the secondary to primary?


Please enter your comment!
Please enter your name here

× How can I help you?