Home / server / Questions / 708306
In Process
Jim B
Asked: 2015-07-25 09:20:11 +0800 CST

Where can you get an ADFS token signing certificate template

  • 772

The topic says it all. Had anyone generated a self signed token signing cert from a template and where can you download a template (not a tool like makecert)? This is not the generic SSL cert, but a token signing cert.

certificate

3 Answers

  1. I think you are looking for a template you can publish in your Windows CA so when someone needs to request an ADFS certificate they can select that template at issuance. If so, I think this is what you are looking for: https://technet.microsoft.com/en-us/library/Dn781428.aspx (note: the title says just getting a certificate but the instructions walk you through setting up the template first).

    • 1

  2. Not sure about a "template", but this question offers a number of ways to generate the certificate - makecert, openssl, and SelfSSL:

    https://stackoverflow.com/questions/14464441/how-to-create-a-self-signed-x509-certificate-with-both-private-and-public-keys

    • 0

  3. I used the following in my lab. It worked for me.

    Made an tokencert.inf file like so.

    [NewRequest]
Subject = "CN=Self Signed Cert"
KeyLength = 2048
ProviderName = "Microsoft Enhanced Cryptographic Provider v1.0"
KeySpec = 1
KeyUsage = 0
RequestType = Cert
SMIME = False
ValidityPeriod = Years
ValidityPeriodUnits = 2
Exportable = True

    Then used 

    certreq -new c:\temp\tokencert.inf c:\temp\tokencert.crt

    used certmgr.msc to export from user store with private key as pfx and import to machine store. You can also export/import via Powershell etc if you prefer.

    I have not tested this extensively. Feel free to post back if it fails any scenarios.

    • 0