Question

I keep getting this error message in my Event log:

The root of the certificate chain is not a trusted root authority

It seems to be working fine, but I don’t like the sound of that error, anyone know why and how to fix this?

Answer 1

The reason is that Sharepoint has it’s own registry of certificates, and you will have to add the CA there as well.

1. Open “ADFS 2.0 Management”
2. Expand Service – Certificates
3. Right click the primary (if more than one) certificate under Token-signing, and select View Certificate
4. Choose the Details tab, and click “Copy to file…”
5. Complete the wizard, saving the certificate as “DER encoded binary” (name it ADFSRoot.cer or something)
6. Copy the .cer file over to your Sharepoint server

Now you have to add this certificate to Sharepoints list of root authorities. You’ll be using the Sharepoint 2010 Management Shell for this operation:

First you start Sharepoint 2010 Management Shell and then you run the following two commands (change the path to where your .cer is located):

$root = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2("C:\TEMP\ADFSroot.cer")
New-SPTrustedRootAuthority -Name "ADFS Token SigningRoot Authority" -Certificate $root

Now the certificate properties will be listed as a confirmation that the certificate has been added.

If your certificate chain contains more than one certificate, you will have to do this with each one giving them a unique name.