"AD FS Token-Signing certificate is not valid" error after you run the MOSDAL Support Toolkit

After you run the Microsoft Online Services Diagnostics and Logging (MOSDAL) Support Toolkit, the Active Directory Federation Services (AD FS) diagnostics log shows the following error message:Note The log is located at Admin_Applications\SSO_Diagnostic_Tests\ADFSDiagnostic.txt.

Additionally, you may experience one of the following symptoms when you sign in to Office 365 web services by using single sign-on (SSO)-enabled user ID credentials:

• You receive an "Organization could not sign you in" error message from login.microsoftonline.com.
• You receive a "There was a problem accessing this site" error message before you can provide credentials to AD FS.

This issue may occur if one of the following conditions is true:

• The token-signing certificate is expired because the AD FS certificate auto-renew was deactivated.
• The token-signing certificate was auto-renewed but not updated to the Windows Azure AD authentication system.

To resolve this issue, follow these steps.

Step 1

Check the AD FS token-signing certificate for expiration, and renew it as necessary by following the steps in the following Microsoft Knowledge Base article:

Step 2

Whether the AD FS token-signing certificate is expired or not, this error may also be caused if AD FS token-signing certificate was renewed on the AD FS server without the certificate information being updated in the Windows Azure AD authentication system. To update the AD FS token-signing certificate information in the Windows Azure AD authentication system, see the "How to update the configuration of the Office 365 federated domain" section of the following Microsoft Knowledge Base article:

A script is available to automate the regular updates of the federation metadata. This makes sure that changes to the AD FS token-signing certificate are replicated correctly. The script is available at the following Microsoft website:

This script can be deployed as a Windows scheduled task on the primary AD FS server to make sure that changes to the AD FS configuration (such as trust information and signing certificate updates) are regularly propagated to the Windows Azure AD authentication system. If the token-signing certificate is automatically renewed in an environment where the script is implemented, the script will update the cloud trust information to prevent downtime that is caused by out-of-date cloud certificate information.

Still need help? Go to the Office 365 Community website or the Windows Azure Active Directory Forums website.