ADFS server and service provider signing certificate

Question

From ADFS and ADFS 2.0 perspective is it possible to register Service Provider metadata that is using certificate (public key) that is not issued by signing authority ? I mean on self signing certificate.

Answer 1

Yes - you can use a self-signed certificate for the SP and that certificate is reflected in the SP metadata.

So you can generate it with the Java keytool etc.

Also ensure that you generate the certificate for a reasonable period - at least a year otherwise you will have to co0ntinually update the metadata on the ADFS side.

Answer 2

It should not be as described in following document - Certificate Requirements for Federation Servers in section Determining your CA strategy

"ADFS does not require that certificates be issued by a CA. However, the SSL certificate (the certificate that is also used by default as the service communications certificate) must be trusted by the ADFS clients. We recommend that you not use self-signed certificates for these certificate types."