Proxy trust between Web Application Proxy (WAP) and Active Directory Federation Service (AD FS) server is broken

Check the time on all AD FS and proxy servers to make sure that there is no time skew. If there is a skew, sync all system clocks with your organization's reliable time source.

If AD FS is installed on Windows Server 2012 R2, make sure that the following updates are installed:

1. Windows RT 8.1, Windows 8.1, and Windows Server 2012 R2 update: April 2014 https://support.microsoft.com/en-us/help/2919355
2. November 2014 update rollup for Windows RT 8.1, Windows 8.1, and Windows Server 2012 R2 https://support.microsoft.com/en-us/help/3000850/
3. December 2014 update rollup for Windows RT 8.1, Windows 8.1, and Windows Server 2012 R2 https://support.microsoft.com/en-us/help/3013769
4. Time-out failures after initial deployment of Device Registration service in Windows Server 2012 R2 https://support.microsoft.com/en-us/help/3020773/

On the primary AD FS server, get the thumbprint of the SSL certificate by running the following cmdlet in PowerShell:

1. Get-AdfsCertificate -CertificateType Service-Communications | select Thumbprint
2. Run netsh http show sslcert on the first internal AD FS server.
3. From the output above:
   1. Make sure that the hostname matches the AD FS federation service name
   2. Check the thumbprint against the certhash to make sure they match
   3. Ensure that the CTL Store name is "AdfsTrustedDevices"
   4. You may also see an IP Port binding for 0.0.0.0:443
4. Repeat step 2 and 3 for all AD FS and WAP servers.

Use Azure AD Connect to update the SSL certificate on the impacted AD FS and WAP servers. Follow the instruction at Update the SSL certificate for an Active Directory Federation Services (AD FS) farm

Run the following PowerShell command on all ADFS and WAP servers to make sure that there are no non-self-signed certificates in the trusted root cert store>

1. Get-ChildItem cert:\LocalMachine\root -Recurse | Where-Object {$_.Issuer -ne $_.Subject} | Format-List * | Out-File "c:\computer_filtered.txt"
2. Move them to the intermediate store if they exist

Check for any AD FS Replication Errors.

1. Open the AD FS MMC on the secondary servers and look at the last time they synced.
2. Fix any sync issues

For proper WAP - AD FS communication, ensure that the correct service principal name (SPN) is configured on the AD FS service account. Run setspn -f -q host/<federation service name> and run setspn -f -q http/<federation service name> and correct any issues.

1. HOST should resolve to the ADFS service account.
2. HTTP call should resolve to one of the AD FS servers. If SPN lookup resolves to an unrelated computer account, the authentication between the servers will fail.

Reset the WAP trust using the Install-WebApplicationProxy PowerShell cmdlet

Example: If the thumbprint of the SSL cert is 3638de9b03a488341dfe32fc3ae5c480ee687793 and the federation service name is fs.contoso.com

Run, Install-WebApplicationProxy -FederationServiceName fs.contoso.com -CertificateThumbprint "3638de9b03a488341dfe32fc3ae5c480ee687793"

Congratulations! Your issue has been solved.

We are sorry that the problem persists. We'd appreciate it if you can provide feedback with details of your issue so that we can improve the troubleshooting workflows.