How to reestablish WAP Proxy Trust ?

Question

How to reestablish WAP Proxy Trust ?

Horak David 0

Hello Support team,

External authentication is failing across the WAP farm, and Event ID 422 indicates that the trust between WAP and the internal AD FS farm has become invalid. This usually happens after certificate rotation or when the proxy configuration falls out of sync. I need help !!!

0 comments

2 answers

Your answer

Answer 1

Hello Horak David,

Event ID 422 is a strong indicator that the trust relationship between your Web Application Proxy servers and the AD FS farm has expired or become invalid, often after certificate rotation or configuration drift.

The recommended way to reestablish trust is to re-run the proxy configuration wizard on each WAP server. You can do this by opening the Remote Access Management console and selecting “Run the Web Application Proxy Configuration Wizard.” When prompted, provide the AD FS service name and valid administrative credentials. This process re-registers the proxy with AD FS and re-establishes the trust using the current certificates.

If you prefer PowerShell, you can use the Install-WebApplicationProxy cmdlet with the -FederationServiceName and -FederationServiceTrustCredential parameters to achieve the same result. After reconfiguration, verify that the WAP servers have the correct SSL certificate bound and that the AD FS service communication is healthy.

It’s also a good practice to monitor certificate lifecycles and automate renewal where possible, so that trust does not break unexpectedly in the future. Once the trust is restored, external authentication should resume without errors.

I hope the response provided some helpful insight. If you find this answer useful, please hit “accept answer” so I know it addressed your concern.

Jason

Answer 2

Use this recovery path for broken WAP proxy trust:

Verify time and time zone on every AD FS and WAP server. Proxy trust can fail if clocks are skewed or if time matches but the time zone does not.
Check the AD FS TLS/SSL binding on the primary AD FS server:
- Run Get-AdfsCertificate -CertificateType Service-Communications | select Thumbprint
- Run netsh http show sslcert
- Confirm the hostname matches the federation service name.
- Confirm the certificate thumbprint matches the certhash.
- Confirm the Ctl Store Name is AdfsTrustedDevices.
- Repeat the netsh http show sslcert check on all AD FS and WAP servers.
Check certificate stores:
- In AdfsTrustedDevices, keep only the MS-Organization-Access certificate and the proxy trust certificates for the WAP servers.
- Delete any CA-issued, non-self-signed TLS/SSL server certificate from AdfsTrustedDevices.
- On all AD FS and WAP servers, check the trusted root store for non-self-signed certificates:
```
     Get-ChildItem cert:\LocalMachine\root -Recurse | Where-Object {$_.Issuer -ne $_.Subject} | Format-List * | Out-File "c:\computer_filtered.txt"
```
  If any are found there, move them to the intermediate store.
If the certificate was recently rotated, update the TLS/SSL certificate settings on the affected AD FS and WAP servers. If Microsoft Entra Connect Sync is present, use it to update the TLS/SSL certificate bindings on all servers. If it is not present, regenerate the AD FS certificate binding on the AD FS server with:
```
   Set-AdfsSslCertificate -Thumbprint <thumbprint>
```
Check for SSL/TLS termination between WAP and AD FS. If a network device is terminating SSL/TLS between them, disable that termination because WAP-to-AD FS communication depends on client certificates.
Check AD FS replication health on secondary AD FS servers in the AD FS MMC and fix any sync issues.
Validate the AD FS service account SPNs:
- setspn -f -q host/<federation service name>
- setspn -f -q http/<federation service name> The host SPN should resolve to the AD FS service account, and the HTTP SPN should resolve to one of the AD FS servers.

Re-establish the WAP trust. This is the supported reset step when trust is invalid:

   Install-WebApplicationProxy -FederationServiceName fs.contoso.com -CertificateThumbprint "<thumbprint>"

If replacing the WAP TLS/SSL certificate and the old certificate has already expired, reconfigure the proxy with credentials for a domain user who is a local administrator on the AD FS server:

   $cred = Get-Credential
   Install-WebApplicationProxy -FederationServiceTrustCredential $cred -CertificateThumbprint '<thumbprint of new cert>' -FederationServiceName 'fs.contoso.com'

If PowerShell reports that the trust certificate is not valid or configuration data was not found in AD FS, run Install-WebApplicationProxy again after confirming clock sync and AD FS reachability.