Skip to content
English
  • There are no suggestions because the search field is empty.

Why might Windows ADFS fail to start after updating certificates?

Resolve ADFS startup error 7023 by granting the service account read access to the new certificate’s private key.

Permissions for access to the new ADFS certificate have to be given to the ADFS service account.

Problem

With a new certificate selected for service signing, token decrypting, and token signing, a restart of ADFS resulted in the ADFS service not starting with event ID 7023 reported in the System event log.

Solution

This is fixed by giving the ADFS_SVC account (service account) permissions to read the certificate’s private key using the certificate management snap-in on the ADFS Server.

The section is accessed via the “Manage Private Keys” option in the context menu for the cert.