ADFS Certificate - What name? - Local Domain or Web Domain?

[ronnoco]

Hello all,

 

May be an obvious question but i'm just not sure so was hoping someone could clarify.

 

We have purchased FROG VLE and want to set-up ADFS to enable SSO. Never used ADFS before and we are working through the set-up and have got to the part where we need an SSL certificate.

 

What address well we need to get the certificate signed to? They will be using it in school and at home. Our school domain is nwhs.local and our website is nwhs.uk

 

Any help much appreciated.

[Roberto]

You will need a server communication certificate for the ADFS server itself (and any web application proxy you're also using with it) that allows clients and relying trust partners to connect securely to the ADFS server. This is what will will allow the server to communicate over SSL/TLS

 

This will need to be a valid certificate for the FQDN of the ADFS server both internally and externally, and should probably be from a public certificate authority. I would suggest using a name such as federate.nwhs.uk and buying a certificate soley for that URL rather than using a wildcard, though wildcart certificates should work if you already have one handy.

 

As for how you publish the endpoint to your users' devices, I would suggest making the same address valid for the server internally as well as externally, e.g. wherever clients are they will need to redirect to federate.nwhs.uk for authentication and you may need to do some fiddling with DNS to make this work if you are using a different internal and external domain name root.

 

You will also need token decrypting/signing certificates, which can be generated by the ADFS server itself if you choose. These will not be trusted by third parties, though this actually should work for most ADFS scenarios. If you do need to get a publicly trusted certificate for these too, I would say it should be a different certificate to your service communication certificate.

 

Microsoft have some more info on their website:

https://technet.microsoft.com/en-us/library/dn781428%28v=ws.11%29.aspx is a good techie dive into what's needed

https://blogs.technet.microsoft.com/adfs/2007/07/23/adfs-certificates-ssl-token-signing-and-client-authentication-certs/ is older and written with an old version of ADFS in mind but has a very clear explanation of certificate requirements.

Edited July 20, 2017 by Roberto

[ronnoco]

Hi Roberto,

 

That's brilliant, thanks ever so much for clarifying and great idea with the name of federate.nwhs.uk and re-directing. I'll do exactly that.

 

I'll get looking for a public certificate authority and get one ordered.

 

Kind Regards