Export the Private Key Portion of a Server Authentication Certificate

  • Article

Applies To: Windows Server 2008

Every federation server in an Active Directory Federation Services (AD FS) server farm must have access to the private key of the server authentication certificate. If you are implementing a server farm of federation servers or AD FS-enabled Web servers, you must have a single authentication certificate. This certificate must be issued by an enterprise certification authority (CA), and it must have an exportable private key. The private key of the server authentication certificate must be exportable so that it can be made available to all of the servers in the farm.

Membership in Administrators, or equivalent, on the local computer is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at Local and Domain Default Groups (https://go.microsoft.com/fwlink/?LinkId=83477).

To export the private key portion of a server authentication certificate

  1. Click Start, point to All Programs, point to Administrative Tools, and then click Internet Information Services (IIS) Manager.

  2. In the console tree, click ComputerName.

  3. In the center pane, double-click Server Certificates.

  4. In the center pane, right-click the certificate that you want to export, and then click Export.

  5. In the Export Certificate dialog box, click the … button.

  6. In File name, type **C:\**NameofCertificate, and then click Open.

  7. Type a password for the certificate, confirm it, and then click OK.

  8. Validate the success of your export by confirming that the file you specified is created at the specified location.

Important

So that this certificate can be imported to the local certificate store on the new server, you must transfer the file to physical media and protect its security during transport to the new server. It is extremely important to guard the security of the private key. If this key is compromised, the security of your entire AD FS deployment (including resources within the organization and resource partner organizations) is compromised.

  1. Import the exported server authentication certificate into the certificate store on the new server before you install the Federation Service. For information about how to import the certificate, see IIS 7.0: Import a Server Certificate (https://go.microsoft.com/fwlink/?LinkId=108283).