SSO Google with ADFS certificate change

[k-strider]

Ok I've just used Azure AD Connect to change my soon to expire SSL cert for my ADFS server and ADFS WAP server all really easy. (2012 R2 Servers)

 

I'm now just trying to sort out google sso which is still working but im concious that come middle of feb when the old cert expires it will stop working. some one else came and set the google stuff for me so im just muddling through.

 

using this doc which is really about setting it up https://icutsman.wordpress.com/2016/08/06/googleappsandadfs/

i get that i probably have to replace the cert in Relay Party Trust so i exported the cert as per the instruction in the above blog so i could import it into the google admin center at the end of the post. i have added it under signature in the Relay Party Trusts

but when i upload the cert to google it breaks if i re upload the old one it works again... am i missing something on the ADFS server? i cant find any docs on just updating the certificate only about setting up ADFS SSO from scratch.

 

any help would be greatly appreciated.

[k-strider]

i needed under certificates change Token-Signing new one to primary....

Edited January 31, 2019 by k-strider

[k-strider]

except that then broke office 365 sso... so i've put it back and uploaded the old one to google i guess ive got two weeks to sort it out...

[k-strider]

Right so i hat to run some powershell on my ADFS server to get the token into the o365 cloud - i am going to put a Doc together tomorrow of everything i had to do to change the cert for a year and a half's time when i have to do it again....

 

Import-Module MSOnline

Connect-MsolService

Get-MsolFederationProperty -DomainName domain.sch.uk | FL Source, TokenSigningCertificate

Update-MSOLFederatedDomain –DomainName domain.sch.uk