ADFS Token-Signing Cert Expired (Auto-rollover bypassed) / Need safe manual rollover steps

Question

ADFS Token-Signing Cert Expired (Auto-rollover bypassed) / Need safe manual rollover steps

Lyn 60

Hi team,

We have a P1 incident on ADFS. The automated token-signing certificate rollover failed to trigger, and current cert is already expired. Federated login for all integrated apps is currently down.

We need to execute a manual certificate renewal immediately. However, we must ensure we don’t disrupt the existing relying party trusts (RPT) during the process. We cannot afford to have partners' auth pipelines choke.

What is our standard operating procedure to renew this manually and sync the metadata smoothly? Do we need to disable AutoCertificateRollover first via PowerShell before we push the new primary cert, or can we just let it roll?

Please advise on the safest way to execute this. Loop in anyone who has done this recently.

0 comments

Answer accepted by question author

0 additional answers

Your answer

Answer 1

Hello,

in this situation you cannot rely on AutoCertificateRollover because the existing token‑signing certificate is already expired. Once that happens, ADFS will not generate a new one automatically, and relying party trusts will reject tokens until a valid primary certificate is in place. The safest way forward is to perform a manual certificate renewal and then update the federation metadata so that all relying parties consume the new key without interruption.

The standard operating procedure is as follows: first, disable AutoCertificateRollover temporarily to prevent ADFS from attempting to generate another certificate in parallel. This is done with PowerShell on the ADFS server:

Set-ADFSProperties -AutoCertificateRollover $false

Next, generate a new token‑signing certificate manually. You can do this from the ADFS Management console under Service > Certificates, or via PowerShell with Add-ADFSCertificate -CertificateType Token-Signing. Once the new certificate is created, mark it as primary. At this point, ADFS will start signing tokens with the new certificate.

The critical step is to ensure that all relying party trusts are updated with the new certificate information. If your partners consume federation metadata automatically, you should immediately publish the updated metadata and confirm that they refresh it. If they do not consume metadata automatically, you will need to provide them with the new public key so they can import it into their trust configuration. This is what prevents disruption in their authentication pipelines.

After you have confirmed that all relying parties are updated, you can re‑enable AutoCertificateRollover so that future renewals happen automatically:

Set-ADFSProperties -AutoCertificateRollover $true

In short, yes, you should disable AutoCertificateRollover before pushing the new primary certificate, otherwise ADFS may attempt to generate another rollover certificate and complicate the trust chain. The safest path is manual renewal, metadata sync, partner validation, and then re‑enable rollover.

I hope you've found something useful here. If it helps you get more insight into the issue, it's appreciated to accept the answer. Should you have more questions, feel free to leave a message. Have a nice day!

Domic Vo.