Field note / 31 July 2013
Renewing an ADFS token signing certificate for SharePoint
A certificate renewal is a short task with a long blast radius. The preparation decides whether anyone notices.
When Active Directory Federation Services signs a token, SharePoint trusts the signing key behind it. Replacing that key without updating the trust on both sides produces a predictable result: valid users are rejected and the login flow fails before SharePoint can help.
The renewal itself is not especially complicated. The risk sits in the coordination. The certificate has an expiry date, a thumbprint and a trust relationship that must be updated in the right order. Every one of those details should be recorded before the change window.
Run the renewal as a rehearsal
Copy the current configuration into a test environment and perform the whole renewal there, including the trust update and a fresh sign in. Note the delay before the new metadata is recognised. Confirm which service accounts need to read the certificate and whether any servers cache the old trust.
During the change, keep the old certificate available until the new one is proven. Monitor the federation service and the SharePoint usage logs together. A successful browser login is a good sign, but it does not replace a check of the token validation path on every server.
The short list
Checks worth running
- Record the certificate subject, thumbprint, expiry and every trust that references it.
- Rehearse the change in a farm that uses the same identity configuration.
- Keep the previous certificate available until all nodes have been tested.
The reliable approach is procedural rather than heroic. Know the dependency, rehearse the handoff and keep evidence that both ends of the trust are using the expected key.
Outside reading
Reference shelf
Official documentation and independent community reading for the subjects in this note.
- Microsoft Learn: Microsoft Entra documentation (opens in a new tab)Identity platform guidance covering federation, certificates and access policy.
- Microsoft Learn: SharePoint administration (opens in a new tab)Operational guidance for service settings, site management and the modern admin experience.
- Microsoft Support (opens in a new tab)Support articles, troubleshooting steps and product help from Microsoft.
- Microsoft Learn: Windows Server documentation (opens in a new tab)Current guidance for Windows Server roles, networking, storage and management.
- Microsoft Tech Community (opens in a new tab)Community discussion, product announcements and practical posts from Microsoft teams.
- Microsoft Learn Q&A (opens in a new tab)A community question and answer space hosted by Microsoft.
- SharePoint Stack Exchange (opens in a new tab)An independent question and answer community for SharePoint practitioners.
- Microsoft Security blog (opens in a new tab)Microsoft guidance on security research, response and platform protection.
- Microsoft Security Response Center (opens in a new tab)Security advisories, update guidance and vulnerability response information.
- Microsoft Learn: PowerShell documentation (opens in a new tab)Language reference, cmdlet documentation and guidance for repeatable automation.
- Microsoft Learn: SharePoint documentation (opens in a new tab)The starting point for current SharePoint administration, development and hybrid guidance.
- Microsoft Download Center (opens in a new tab)Official downloads for Microsoft tools, updates and supporting packages.
- Microsoft Learn: SharePoint search (opens in a new tab)Documentation for search architecture, crawling and result management.
- PowerShell Gallery (opens in a new tab)A public repository for PowerShell modules and scripts. Review package provenance before use.
- Microsoft Learn: SQL Server documentation (opens in a new tab)Official reference material for database engine configuration, performance and recovery.