Skip to content
Docs sslbrain sslbrain.com

Dynamics 365 CE / CRM (IFD)

Copy link to the page “Dynamics 365 CE / CRM (IFD)”

← All integrations

Windows · Apps and databases

Renews the certificate on Dynamics CRM with claims-based authentication and IFD, and updates AD FS, so sign-in works afterwards without Deployment Manager.

The service agent on the server fetches the task from the appliance over outbound HTTPS on port 443 and installs the certificate locally on the server. The appliance never connects to the server.

What happens

  1. The service agent on the server fetches the task from the appliance over outbound HTTPS, port 443.
  2. The Windows basics first import the certificate into the Windows certificate store (LocalMachine\My).
  3. The CRM website's HTTPS bindings, on the port CRM uses, switch to the new certificate, and the CRMAppPool account gets read access to the key. The old certificate with the same subject is archived, so CRM finds the new one as its claims encryption certificate, and IIS is restarted. If it fails: Rollback puts the previous certificate back on the bindings and archives the new one; then run the AD FS step again.
  4. AD FS: the AD FS integration refreshes CRM's relying party trusts from CRM's federation metadata, so AD FS encrypts sign-ins to the new certificate.
  5. Verification: the integration checks that CRM serves and publishes the new certificate.

Technical details

Connection
The integration runs through the service agent on the server. The service agent connects over outbound HTTPS to the appliance, port 443 by default. You open no port into the server.
Service ports
443, 444
What you need
The service agent installed on the server. The service agent on the CRM server (Full Server or Front End) and on the AD FS server. A renewal with the same subject needs no CRM account; when the subject changes, give a CRM Deployment Administrator as the login.
Platform
Dynamics CRM 2016 and Dynamics 365 CE on-premises 9.x, Windows Server 2012 R2 and later
Actions
Discovery, Installation, Verification, Rollback
Integrations
dynamics-crm-windows 1.0.0 windows-adfs 1.2.0
Note
  • Use one certificate that covers every CRM address: a wildcard for the IFD domain covers the organization, auth., dev. and internal addresses when they are in the same domain. Its key must be in a legacy CSP; CRM does not use a CNG key.

Next steps