Export the private key portion of a token-signing certificate
Applies To: Windows Server 2003 R2
Every federation server in an Active Directory Federation Services (ADFS) server farm must have access to the private key of the token-signing certificate. If you are implementing a server farm of federation servers that share a single, exportable private key certificate that is issued by an enterprise certification authority (CA), the private key portion of the existing token-signing certificate must be exported to make it available for importing into the certificate store on the new server.
To complete this procedure, you must be a member of the Administrators group on the local computer.
To export the private key of a token-signing certificate
Click Start, point to Administrative Tools, and then click Active Directory Federation Services.
Right-click Federation Service, and then click Properties.
On the General tab, click View.
In the Certificate dialog box, click the Details tab.
On the Details tab, click Copy to File.
On the Welcome to the Certificate Export Wizard page, click Next.
On the Export Private Key page, select Yes, export the private key, and then click Next.
On the Export File Format page, select Personal Information Exchange = PKCS #12 (.PFX), and then click Next.
On the Password page, type and confirm the password that is required to share the token-signing certificate. You will need this password when you select the exported token-signing certificate when installing the Federation Service.
On the File to Export page, specify the certificate file, and then click Next.
On the Completing the Certificate Export Wizard page, click Finish.
Validate the success of your export by confirming that the file you specified is created at the specified location.
So that this certificate can be imported to the local certificate store on the new server, you must transfer the file to physical media and protect its security during transport to the new server. It is extremely important to guard the security of the private key.
Import the exported certificate into the certificate store on the new server prior to installing the Federation Service. For information about how to import the certificate, see Import a certificate (https://go.microsoft.com/fwlink/?linkid=20040).