File System location of AD FS's Token-Signing Certificate

Question

On Windows Server 2012, where does ADFS store the automatically generated Token-Decrypting certificate?

I manually checked the usual places and could not find it: C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys

I was able to identify the Service-Communications cert and Token-Signing certificate.

Answer 1

ADFS was configured to run under a specific account, the certificate was located under there Roaming profile. This path is only applicable for certficates that are automatically generated when ADFS is first configured. Once expired, I recommend installing a new cert is LocalMachine store instead.

C:\Users\<AccountNameRunningADFS>\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates

Answer 2

On our boxes (WID / automatic rollover), they are stored in a container in AD under:

Program Data / Microsoft / ADFS

Answer 3

Self-signed certificates are stored in the SQL / WID database, not the Certificates MMC