Certificates
Applies To: Active Directory Federation Services (AD FS) 2.0
The Federation Service in Active Directory Federation Services (AD FS) 2.0 uses certificates for issuing and receiving tokens, publishing federation metadata, or communicating through Secure Sockets Layer (SSL).
The following table describes the four types of certificates that the Federation Service uses.
| Type | Description |
|---|---|
Token-signing certificate |
Used to sign tokens that the Federation Service issues. Other purposes for this type of certificate include the following:
AD FS 2.0 generates the default token-signing certificate automatically by using the SHA1 hash algorithm as part of the initial configuration process. The list of these certificates that appear in the AD FS 2.0 snap-in represents the contents of the Personal certificate store folder. You can view the contents of this folder by using the Certificates snap-in on the same local computer running AD FS 2.0. |
Token-decrypting certificate |
Used to decrypt tokens that the Federation Service receives. AD FS 2.0 uses the SSL certificate for Internet Information Services (IIS) as the default decryption certificate. |
Service communication certificate |
Used for Windows Communication Foundation (WCF) Message security by this Federation Service. AD FS 2.0 uses the SSL certificate for IIS as the default service communication certificate. |
For more information about how to plan your certificate strategy before you deploy a federation server, see Certificate Requirements for Federation Servers (https://go.microsoft.com/fwlink/?LinkId=182466) in the AD FS 2.0 Design Guide.
How primary certificates work
While you can use AD FS 2.0 to add and configure multiple certificates for each of the supported certificate types, you must set a single certificate as the primary certificate when you configure service properties. The primary certificate is used in the following ways for signing and decrypting tokens:
For token signing, all certificates are published, but AD FS 2.0 uses only the primary token-signing certificate to actually sign tokens.
For token decryption, all certificates can be used for decryption, but only the primary token-decrypting certificate is actually published.
Recommendations regarding key length
Certificates are used to secure the Federation Service and its trust relationships. For these purposes, a key length of no less than 2,048 bits is recommended for current and future deployments. RSA keys that have a key length of 1,024 bits may be vulnerable to cryptanalytic attacks in the foreseeable future. To ensure security, use a default key length of 2,048 bits or more. This is the default that is provided by the Microsoft Strong Cryptographic Provider, as well as other cryptographic service providers (CSPs).