Back

ADFS Token Signing Certificate Expiry Causes Sign-On Errors

When you install ADFS you must upload your certificate settings thumbprint to the Federated Relying Party in this case Office 365 The default exp...

2 min read
Published on Apr 8, 2012
ADFS Token Signing Certificate Expiry Causes Sign-On Errors

When you install ADFS, you must upload your certificate settings/thumbprint to the Federated Relying Party, in this case, Office 365.  The default expiration with standard ADFS 2.0 installation is a self signing certificate that expires every year.

Symptoms of user Errors in Browser on Office 365 Portal/Service Logon using federated identity:

  • “There was a problem accessing the site. Try to browse the site again.”
  • “Your organization could not sign you in to this service. There may be a system error. Please contact administrator at your organization if this problem persists.”

Application and Services Logs > ADFS 2.0 > Admin:

  • Event ID 358: Restarting Issuance ServiceHost. This restart is necessary because a change was detected in the certificates that this service host uses. Requests that are served by endpoints of this service host may fail during restart.

Potential Solution If these events occur, it’s a good bet your ADFS signing certificate expired and must be Ensure latest Microsoft Online Services Module for PowerShell installed. Download the module for your 32 or 64 bit system here.

Note - Microsoft Online Services Identity Federation Management PowerShell Module is deprecated and everything can now be configured in the Microsoft Online Services Module.

Powershell Commands:

  • Connect-MsolService Note - You will be prompted for credentials, enter a NON-Federated Office 365 admin account.

  • Optional, only If you’re NOT Running PowerShell From ADFS server: Set-MSOLAdfscontext -Computer YourAdfsServer.mydomain.local

  • Update-MSOLFederatedDomain -DomainName YourDomain.com

  • You can verify the thumbprint updated on Microsoft Online Federation gateway:Get-MSOLFederationProperty -DomainName YourDomain.com

Note – You will also need to update your other SAML Relying Parties such as Concur, Webex, Salesforce, Zendesk, and Google Apps.

If you would like assistance in federation for your organization, please learn more about AgileIdentity, our fixed price identity and access solution.

This post has matured and its content may no longer be relevant beyond historical reference. To see the most current information on a given topic, click on the associated category or tag.

Related Posts

Azure Migration Made Easy Tools Automation and Best Practices

Azure Migration Made Easy: Tools, Automation, and Best Practices for a Smooth Cloud Transition

Simplify your Azure migration with the right tools and automation. Explore Azure Migrate, Site Recovery, DevOps, and third-party solutions for an efficient cloud transition.

May 26, 2025
7 min read
How to Enable Cross-Cloud Collaboration Between GCC High and Office 365

How to Connect GCC High and Office 365 for Cross-Cloud Collaboration

Learn how to securely connect GCC High and Office 365 for cross-cloud collaboration. Explore supported features, limitations, and compliance best practices.

May 22, 2025
6 min read
Key Controls for Achieving CMMC Level 2

Key Controls for Achieving CMMC Level 2 Compliance

Discover the key security controls required for CMMC Level 2 compliance. Learn how to implement NIST 800-171 practices to protect Controlled Unclassified Information (CUI).

May 21, 2025
7 min read
Understanding CMMC Enclaves: A Guide for DoD Contractors

CMMC Enclaves: Your Comprehensive Guide to Protecting CUI

Discover how CMMC enclaves can streamline compliance and bolster security by isolating Controlled Unclassified Information (CUI) within a secure environment.

May 21, 2025
7 min read
How MSPs, RPOs, and C3PAOs Help Organizations Achieve CMMC Compliance

How MSPs Help Organizations Achieve CMMC Compliance

MSPs, RPOs, and C3PAOs play a crucial role in CMMC compliance. Learn how to choose the right consultant, third-party auditor, or provider to meet CMMC certification requirements.

May 20, 2025
8 min read
CMMC Compliance Requirements for Level 1 Level 2 and Level 3

CMMC Compliance Requirements for Level 1 Level 2 and Level 3

CMMC certification requires different cybersecurity controls at each level. Learn the key requirements for Level 1, Level 2, and Level 3 compliance and how they align with NIST 800-171.

May 16, 2025
5 min read

Ready to Secure and Defend Your Data
So Your Business Can Thrive?

Fill out the form to see how we can protect your data and help your business grow.

Loading...
Secure. Defend. Thrive.

Let's start a conversation

Discover more about Agile IT's range of services by reaching out.

Don't want to wait for us to get back to you?

Schedule a Free Consultation

Location

Agile IT Headquarters
4660 La Jolla Village Drive #100
San Diego, CA 92122

Secure. Defend. Thrive.

Don't want to wait for us to get back to you?

Discover more about Agile IT's range of services by reaching out

Schedule a Free Consultation