Dynamics Community Forum Thread Details

Issues after change of certificate

Windows 2016 - CRM 2016 v 8.2.28 - ADFS 3

We have been running this setup for ages without any issues. I have had to replace our wildcard certificate and since then we have had problems.

Originally the federated service stopped with some 20 days left on the original certificate. I followed so may threads on how to replace the certificate, but cannot access the system from outside. Also internal systems that use the discovery service can no longer connect. There has been no changes to the DSN's

IFD is set to auth.mydomain:444 , internal.mydomain:444 , adfs.mydomain:444 and all these resolve and I can view the metadata. I think the issue may be with dev (dev.mydomain) If when configuring IFD i use dev.mydomain:444 I get a error on root domains - The Discovery Web Service could not be accessed. The domain is unavailable or does not exist., but passes if i just use dev.mydomain

I have installed / uninstalled ADFS several times over the last week in a bid to try and resolve this. I am no techie, just followed the guides on setting AFDS up. Can anyone help me to resolve this?

Do you by chance use the same wildcard cert to protect the ADFS site as well as CRM? There are several things that could be the cause here:

Does your ADFS site use the same wildcard certificate? Was the certificate updated on the ADFS server?
Did you switch CRM over to the new certificate yet? Which certificate is protecting the federation metadata url for both CRM & ADFS? Do they match?
Does your ADFS have auto-rollover disabled? If it does not, which certificate is showing as primary and which as secondary? There is a potential mismatch between the key coming from CRM and the expected key from ADFS. This article was written for CRM 2011, but it is relevant to this day for newer versions of CRM as well.
1. learn.microsoft.com/.../microsoft-dynamics-crm-2011-log-in-issue-due-to-ad-fs-certificate-rollover

My guess is the problem will be resolved with #3, but you should go through the list in that order to ensure nothing may have been missed along the way. If you are still unable to connect, check the event viewer on ADFS to see what is being thrown as an error.

Quick Links