Resolving ADFS Site Unreachability (Accessible Only via Localhost) by Adding SSL Binding to 0.0.0.0:443

by

When working with Active Directory Federation Services (ADFS), one common pain point is SSL bindings and how ADFS responds to requests via hostname vs. raw IP.

Recently, I encountered the following scenario:

  • Primary ADFS server → reachable via both FQDN and IP.
  • Secondary ADFS server → unreachable from anywhere on the network (internal or external) using hostname or IP.
  • The only way the secondary server was reachable was via localhost on the machine itself.

This caused both the Load Balancer (LB) and ADFS Proxy (WAP) to mark the server as offline.

The Root Cause

ADFS relies on HTTP.sys for HTTPS bindings. By default, ADFS binds its SSL certificate only to the service hostname (e.g., adfs.domain.com), not to the raw IP.

This means:

  • Accessing via FQDN works if the binding exists.
  • Accessing via IP fails since no SSL binding exists for the IP address.

The primary server may have appeared to work because of configuration differences or certificate validation bypass during testing.

The Solution

The fix is to explicitly bind the ADFS service certificate to all interfaces (0.0.0.0:443). This ensures the certificate is served no matter which IP the LB, proxy, or clients use.

Step 1: Get the Certificate Thumbprint

Using PowerShell:

Get-ChildItem Cert:\LocalMachine\My | Where-Object { $_.Subject -like "*adfs*" } | Select-Object Subject, Thumbprint

Alternatively, via MMC Certificates snap-in:

  1. Run mmc.
  2. Go to File > Add/Remove Snap-in….
  3. Select Certificates → Computer account → Local computer.
  4. Expand Certificates (Local Computer) > Personal > Certificates.
  5. Locate the ADFS service certificate (with adfs.domain.com as Subject).
  6. Open it → go to Details tab → copy the Thumbprint (ensure no hidden spaces).

Step 2: Add SSL Binding to All Interfaces

Run this command (replace <Thumbprint> with your actual value, no spaces):

netsh http add sslcert ipport=0.0.0.0:443 certhash=<Thumbprint> appid={5d89a20c-beab-4389-9447-324788eb944a}

Step 3: Verify the Binding

netsh http show sslcert

You should now see ip port 0.0.0.0:443 listed.

(Optional) Rollback

If you need to remove the binding:

netsh http delete sslcert ipport=0.0.0.0:443

The Result

After applying this fix:

  • The Load Balancer and Proxy could connect to both ADFS servers.
  • Internal and external communications worked seamlessly.

Important Note

Even with this binding, accessing ADFS directly via IP in a browser will still show a certificate mismatch warning. This is expected, since the SSL certificate is issued for adfs.domain.com and not the raw IP.

For infrastructure devices (LB, WAP), this is not an issue, as they only need the TLS handshake to succeed.

✅ In summary: Binding the SSL certificate to 0.0.0.0:443 ensures ADFS responds over any IP, making it reliable for environments with load balancers and proxies.

Leave a Comment