Solved

ADFS setup with multiple domains. Certificate and A records requirements for multiple domains.

Posted on 2014-03-03
3
2,980 Views
Last Modified: 2014-03-03
Hello,
I just wanted to verify if you need to use several UPNs and federate several domains with one ADFS server for Office 365, do you need an additional names for each on the cert as well as A record in external DNS to point to ADFS proxy?

I am reading that you only need one A record to point to the FQDN of your ADFS farm and just one name on the cert? Correct?

Also, on the cert, does the FQDN of the server farm needs to be common name or it can just be alternative name? So, if this can be an alternative name, then we can use the UCC cert, for example, from the Hybrid server, and just add adfs.domain.com as an alternative name? What is the best practice? Is it best to buy a separate certificate for ADFS server with common name as adfs.domain.com?

Please, advice.
Thank you very much.
0
Comment
Question by:claudiamcse
3 Comments
 
LVL 38

Accepted Solution

by:
Vasil Michev (MVP) earned 500 total points
Comment Utility
The subject name should point to the FQDN, if you only have the FQDN added to the SAN it might not work: http://technet.microsoft.com/en-us/library/hh341473.aspx

You do not need certificates for other domains, only for the AD FS endpoint. The recommended setup is to create the DNS record sts.domain.com, select the  endpoint sts.domain.com during AD FS setup and select the corresponding SSL certificate with sts.domain.com subject name. The names of course can be different, just make sure all these three pieces match.

You do not need separate certificates for subdomains as well.

Here is also another thread on the community forums that discusses this, and it might help with the other issue you are facing:

http://community.office365.com/en-us/forums/613/p/43477/149671.aspx
0
 
LVL 74

Expert Comment

by:Jeffrey Kane - TechSoEasy
Comment Utility
You'll find all of your answers here:
http://community.office365.com/en-us/forums/613/t/195339.aspx

(and perhaps answers to a few things you haven't asked yet)  :-)
0
 

Author Closing Comment

by:claudiamcse
Comment Utility
Thank you very much! Excellent.
0

Featured Post

Don't lose your head updating email signatures!

Do your end users still have the wrong email signature? Do email signature updates bore you or fill you with a sense of dread? You can make this a whole lot easier on yourself by trusting an Exclaimer email signature management solution. Over 50 million users do...so should you!

Join & Write a Comment

Learn to move / copy / export exchange contacts to iPhone without using any software. Also see the issues in configuration of exchange with iPhone to migrate contacts.
Veeam Backup & Replication has added a new integration – Veeam Backup for Microsoft Office 365.  In this blog, we will discuss how you can benefit from Office 365 email backup with the Veeam’s new product and try to shed some light on the needs and …
In this video we show how to create an email address policy in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.:  First we need to log into the Exchange Admin Center. Navigate to the Mail Flow…
Polish reports in Access so they look terrific. Take yourself to another level. Equations, Back Color, Alternate Back Color. Write easy VBA Code. Tighten space to use less pages. Launch report from a menu, considering criteria only when it is filled…

772 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

9 Experts available now in Live!

Get 1:1 Help Now