SSL for internal ADFS implementation

My domain is: betterdirect.local

I ran this command:

It produced this output:

My web server is (include version):N/A

The operating system my web server runs on is (include version):N/A

My hosting provider, if applicable, is: Go Daddy

I can login to a root shell on my machine (yes or no, or I don't know): yes

I'm using a control panel to manage my site (no, or provide the name and version of the control panel):N/A

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot):?

I would like to deploy Microsoft Server 2019 ADFS. My goal is MFA using Okta as the 2nd factor. ADFS requires an SSL certificate. My challenge is I am using a local domain and would like to install a certificate without creating a website. I would appreciate any guidance on how to do this.

Thanks in advance...

2 Likes

Hi @joeinaz,

Please see Certificates for localhost - Let's Encrypt

3 Likes

If you can use a public fully qualified name for the service (e.g. adfs.yourdomain.com) then you can indeed use a Let's Encrypt certificate, without hosting a web server on that domain, if you use DNS domain validation (instead of http domain validation). Your server/service doesn't have to be public, it just has to be a name that your public DNS can handle.

  • HTTP validation presents a particular challenge response over http (usually the default validation method)
  • DNS validation presents a particular challenge response (an _acme-challenge TXT record) in DNS, for each renewal.

Where DNS validation gets complicated in your case is that the GoDaddy API is restricted to customers with 10 or more domains, so it may or may not work for you depending on how many domains you have with them. To just try it out you can opt to use Manual DNS in the client of your choice, where you manually update the TXT record in DNS. Longer term there are ways to delegate challenge responses to other DNS zones that support automation, if your domain dns doesn't.

You can use a variety of ACME clients to get a cert, e.g.https://certifytheweb.com (which I develop) includes an ADFS deployment task that may work for you. I'd be pretty confident you can use win-acme or Posh-ACME for that as well, with the right scripting. Short term you can use any of these to get a cert (usually as a PFX on windows) and apply that manually to ADFS to get started, long term you need to automate renewals.

5 Likes

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.