Import SSL into ADFS for linking Azure AD to Local AD.

Agolphin 96

So I am attempting to test a huge connection of my azure AD to my Local AD but I need an ADFS in my environment for Federated logins from AzureI am attempting to deploy one but it's asking for an SSL cert

I need support importing an SSL cert into my adfs
I own my domain name.
I can create a csr but there are no public facing CA's to push my request to.
My Domain is hosted inside of google.
Where do i go from here? I added the domain as Verified in Azure.

Accepted answer

Agolphin 96 Reputation points

2019-12-05T21:47:41.333+00:00

Solution: Self Signed my own Cert with my AD DC.

Thanks guys!
Please sign in to rate this answer.
soumi-MSFT 11,716 Reputation points Microsoft Employee

2019-12-06T05:51:44.27+00:00

@Agolphin , It would be great if you can mark the answer or upvote the ideas that you liked and those helped you in formulating the action plan, so that it helps others in the community too.
Sign in to comment

1 additional answer

soumi-MSFT 11,716 Reputation points Microsoft Employee

2019-12-04T18:56:37.26+00:00
@Agolphin , The SSL certificate is termed as the Service Communication Certificate in ADFS and to set a Service Communication Certificate on ADFS, it needs to meet the following requirements:

The service communication certificate must include the server authentication enhanced key usage (EKU) extension.

The certificate revocation lists (CRLs) must be accessible for all the certificates in the chain from the service communication certificate to the root CA certificate. The root CA must also be trusted by any federation server proxies and Web servers that trust this federation server.

The subject name that is used in the service communication certificate must match the Federation Service name in the properties of the Federation Service.

Once you have the SSL issued to you fulfilling the above mentioned requirements, you are all set to update this SSL certificate as the Service Communication Certificate on the ADFS 2016 server, following the steps mentioned in this article.

If its a new deployment of ADFS 2016 farm, please follow the steps mentioned in this article.

Hope this helps.

---------------------------------------------------------------------------------------------------------------------------------------

Please take a moment to "Mark as Answer" and/or "Vote as Helpful" wherever applicable. Thanks!
Please sign in to rate this answer.

1 person found this answer helpful.
Agolphin 96 Reputation points

2019-12-04T19:35:34.66+00:00

I understand that part. I need to generate the SSL cert but ADFS and Microsoft's documentation specifically ask for a Public CA to sign it. My Issue is the Public CA. Let's encrypt is very convoluted.
Google doesn't have a public facing CA even though my domain is in google domains.

How would i get a CA to sign my CSR request? Or do I just sign it with my Local Domain controller?

soumi-MSFT 11,716 Reputation points Microsoft Employee

2019-12-05T05:28:03.13+00:00

@Agolphin , A SSL cert signed/issued by a Public CA is recommended in case of ADFS, is because, based on this certificate, the secure connection to ADFS server is made from any machine over the Internet. Hence the machine who is trying to connect to this ADFS server over SSL, should be able to validate the issuer of that certificate and also the root of that certificate. Thus the requirement of a public signed CA cert comes here.Once you create the CSR, you can also consider vendors like Digicert, VeriSign, Komodo and Thwat.

Agolphin 96 Reputation points

2019-12-05T13:46:00.667+00:00

So theoretically speaking, I don't need a Public CA to sign my cert.

I COULD sign my cert with my ADDC, set him as the Root CA, create a cert with it as a Root CA and Import that Cert on all the machines I would connect to my domain with?

soumi-MSFT 11,716 Reputation points Microsoft Employee

2019-12-05T16:54:57.803+00:00

@Agolphin , Thats correct. You can surely use a certificate that is issued by your domain's CA server. Only overhead is that you will have to make that Root Cert of that CA server available to all the machines around the world from where the ADFS server would be accessed.

Hope this helps.

---------------------------------------------------------------------------------------------------------------------------------------

Please take a moment to "Mark as Answer" and/or "Vote as Helpful" wherever applicable. Thanks!

Agolphin 96 Reputation points

2019-12-05T17:29:18.837+00:00

This helps me alot as I know how to sign my own SSL Cert.
I will use the documentation to test my infrastructure.

When you say make the Root CA available, if all of my machines are local and joined to the local domain, then I set a policy to install a root CA cert on the machine with group policy,

this should allow them to trust the SSL cert that will be installed after and contact the ADFS for federation since DC> AFDS. ADFS will make the request and my DC will sign it.

So when I link it to my Azure AD for Federation there, do I need to import the Azure AD Cert?

Lukas Beran 176 Reputation points

2019-12-05T19:06:49.973+00:00

Yes, you are right. You can technically use self-signed certificate, but it's not recommended for production deployments. For testing/lab it's ok, I had self-signed certificate in my lab as well and just imported the CA root cert to my trusted root certs on my computer.

Agolphin 96 Reputation points

2019-12-05T19:59:51.2+00:00

So if my computers dont leave the building I'm great?

Lukas Beran 176 Reputation points

2019-12-05T20:08:31.14+00:00

Yes you are :-)

Agolphin 96 Reputation points

2019-12-05T20:44:11.943+00:00

Last question.
Where do I get the CA root Cert or how do I generate one from my ADDC.
I'm using OpenSSL to sign my cert request from my adfs but I never understood their positions in my certificate store.

Agolphin 96 Reputation points

2019-12-05T21:46:44.99+00:00

Nevermind. I set my ADDC as a CA and Signed my own Request from my ADFS.

I got this guys.
Sign in to comment