UCPrimer
  • Tech Blog
  • About UCPrimer.com

AD Federation Services failed after renewing SSL Certificate: How to Resolve

8/31/2015

0 Comments

 
Picture
Recently I had to renew the SSL certificate for my AFDS Server and ADFS Proxy, both of which expired in Aug. We installed the ADFS and ADFS Proxy servers in the blog post Road to Lync Hybrid as we configured Lync 2013 for a Hybrid configuration with Office365. That Lync environment has since been upgraded to Skype for Business 2015. Generating a new CSR and obtaining a new cert was the easy part, however problems started appear shortly after for users who were dirsync'ed from AD to O365. They were unable to sign in to the Office365 portal and could not login to Exchange Online from either internal network or external network. Users hosted on Skype4B on-premise servers could still login to Skype5, but only from internal network. Users not dirsync'ed from AD continued to work as normal.
I started checking on the ADFS Proxy server to ensure that the newly installed certificate was indeed correct and it was. But the Event Log was showing error "Event 364 Encountered error during deration passive request":
Picture
A quick search on the internet on this Event ID turned up several possibilities including time skew between the ADFS and ADFS Proxy server, services not running on the ADFS server and certificate mismatch. None of these was happening so I decided to re-run the ADFS Proxy Configuration Wizard, which ran successfully except for a warning that the existing website was detected and not re-installed:
Picture
Picture
Clickong on the above link led to nowhere so further searching on the web provided a way to actually force the ADFS Proxy Configuration Wizard to re-deploy the website. This is done by running the following in a command prompt after which the website will be redeployed when running the wizard:
C:\WindowsSystem32inetsrvappcmd delete app “Default Web Site/adfs/ls

But the problem was still not resolved, but this time a different error was showing on the Event Viewer. An Event ID 248: The federation server proxy was not able to retrieve the list of endpoints from the Federation Service":
Picture
Results from the search query of the event error suggested this could be due to changing the "federation service identifier" from the default http://adfshostname.yourdomainname.com/adfs/services/trust from http to https. This was not the case however, in my server and another possibility that came back was that the ADFS 2.0 Token-decrypting and Token-signing certificates had to be renewed. So I opened up powershell and ran the following cmdlets as advised:
Add-PSSnapin Microsoft.Adfs.PowerShell
Update-ADFSCertificate -Urgent
Picture
With that, there were no new errors being shown in the event viewer, but users could still not sign-in into the Office365 portal using their AD credentials, but this time a different message was being shown on the IE page. This time, although we get directed to the ADFS web login page but entering the credentials shows a message:  "An error has occurred, invalid SAML token." With this error message, I found this support KB https://support.microsoft.com/en-us/kb/3015526 which indicates a known issue with Azure AD. As stated in the article, to resolve this run the following command in PowerShell on the AD FS server:

Update-MsolFederatedDomain -DomainName [verified domain]

Where the [verified domain] is the shared SIP domain for the hybrid setup, which in my case is "ucprimer.com":
Picture
With that, all ADFS services started working again and users dirsync'ed from AD were able to sign-in into the Office365 portal using their AD credentials as well as login to Exchange Online and Skype for Business Online and OnPrem. Hopefully this blog post will help anyone facing similar issues with ADFS. I'm certain this post will come in handy in a year's time when I have to renew my ADFS SSL certificates again.
0 Comments

Your comment will be posted after it is approved.


Leave a Reply.

    Picture
    Picture

    Important Links

    Microsoft Teams Docs
    Microsoft Learn

    ​Microsoft MVP Blogs

    Michael Tressler’s Blog
    Michael’s MTR Quick Tip Videos
    Jimmy Vaughan’s Blog
    Jeff Schertz
    Adam Jacobs
    James Cussen
    ​Damien Margaritis

    Archives

    September 2022
    August 2022
    March 2022
    February 2022
    January 2022
    December 2021
    November 2021
    October 2021
    September 2021
    August 2021
    June 2021
    April 2021
    March 2021
    December 2020
    October 2020
    September 2020
    August 2020
    April 2020
    March 2020
    February 2020
    January 2020
    December 2019
    November 2019
    October 2019
    September 2019
    August 2019
    July 2019
    March 2019
    November 2018
    October 2018
    September 2018
    August 2018
    June 2018
    March 2018
    February 2018
    January 2018
    December 2017
    November 2017
    August 2017
    July 2017
    April 2017
    March 2017
    February 2017
    January 2017
    November 2016
    October 2016
    September 2016
    August 2016
    July 2016
    June 2016
    May 2016
    April 2016
    March 2016
    January 2016
    November 2015
    October 2015
    September 2015
    August 2015
    July 2015
    June 2015
    May 2015
    April 2015
    March 2015
    February 2015
    January 2015
    December 2014
    November 2014
    October 2014
    September 2014
    August 2014
    July 2014
    June 2014
    May 2014
    April 2014
    March 2014
    February 2014
    January 2014
    December 2013
    November 2013
    October 2013
    September 2013
    August 2013
    July 2013
    June 2013
    May 2013
    April 2013
    March 2013
    February 2013
    January 2013
    December 2012
    November 2012
    September 2012
    August 2012

    Categories

    All
    Edge
    Exchange 2013
    Hybrid
    Lpe
    Lync 2010
    Lync 2013
    Mobility
    Oauth
    Office365
    Polycom
    Ucs

    RSS Feed

    This website uses marketing and tracking technologies. Opting out of this will opt you out of all cookies, except for those needed to run the website. Note that some products may not work as well without tracking cookies.

    Opt Out of Cookies