ADFS Export Default Token Signing Certificate Private Key

0
votes

How can I export the Token Signing Certificate that is created when ADFS 3.0 is installed? When I open up the certificate MMC, I am able to see the certificate however the message 'You have a private key that corresponds to this certificate' is missing and I am unable to export the private key. I read in the article ADFS deep dive: Certificate Planning that I can find it in Active Directory in the following container:

CN=ADFS,CN=Microsoft,CN=Program Data,DC=domain,DC=com

However, although I can get to that container, all I see is a GUID inside and do not know how to export the private key out of Active Directory.

How can I get the private key?

******************************************** EDIT ********************************************

In case anyone comes to this later, the certs are actually in the personal cert store of the ADFS service account but they are NOT exportable. You almost certainly want the SSL cert private key NOT the token signing cert private key. The documentation

I was following to set up ADFS for SharePoint was a little confusing. The private key had to exported for the SSL cert, however the thumbprint of the token signing cert had to be placed in the web config. I was incorrectly trying to export the private key of the token signing cert.

******************************************** EDIT ********************************************

1
certificateadfssignadfs3.0

1 Answers

0
votes

You mean the self-signed ones you get with automatic rollover?

If so, where do you see these with mmc?

They are stored in a combination of an AD container and the ADFS DB.

So you can't export in the normal manner.

For a very good reason - security. If you have the private key you can send / hack anything and it will be accepted as coming from ADFS.

The public key is available in the metadata.

If you have to do this, turn off automatic rollover and use your own certificates.