Configuring the Jamf AD CS Connector (Inbound) to Use an Alternate Server Certificate

Technical Paper: Integrating with Active Directory Certificate Services (AD CS) Using Jamf Pro
Solution
Application
Content Type
Technical Documentation
Utilities & Services
Jamf AD CS Connector
ft:locale
en-US

The Jamf AD CS Connector creates secure server certificates when installed. However, if your organization prefers to use certificates created by an internal CA or a third-party CA, you can configure the Jamf AD CS Connector use an alternate server certificate.

Requirements

The alternate server certificate in .pfx format. .pfx format is usually provided by your PKI team.

  1. Click the Start menu, select Run, and then enter certlm.msc to open the Certificate Manager tool.

  2. Right click the Web-Hosting folder, and then click All Tasks > Import.

  3. Follow the wizard's instructions to import the certificate.
  4. Open Internet Information Services (IIS) Manager.
  5. Remove the old certificate.
    Note:

    Communication issues may occur if you do not remove the old certificate before adding the new one.

    1. In the Connections pane on the left, click your server's name (not the website).
    2. In the center pane, double-click Server Certificates.
    3. Locate the old, expired, or unused certificate in the list, and view its expiration date to confirm it is the correct one to be removed.
    4. Select the old certificate, and click Remove in the Actions pane on the right.
    5. Click Yes when the confirmation message appears.
  6. In the Connections pane, open the Sites folder, click on the Jamf AD CS Connector site (by default called "AdcsProxy"), and click Bindings in the Actions sidebar.

  7. In the Site Bindings dialog, select https, and click Edit.
  8. Choose the desired certificate from the SSL certificate pop-up menu.

  9. Click OK.
  10. If your organization is using an internal CA issued certificate, upload the same alternate certificate under Server Certificate using your PKI configuration in Jamf Pro.
Note:

  • If your identity has root or intermediate certificates in its trust chain that were not included in the .pfx file you added to the Windows certificates store, you must also add them.

  • Replace your IIS server certificate prior to expiration. If you do not, Jamf Pro may no longer be able to negotiate TLS connections after the expiration date has passed. The steps are the same as the initial installation steps.