I have an InfoPath form that fetches the current user's name, account, manager, etc.. from AD on form load. Everything works well in the client, how ever when I publish the form to or SharePoint installation, the form errors on load.

I tracked down the correlation error and it seems to be a problem with my cert and being trusted.

Here's the error.

10/18/2011 14:17:57.73 w3wp.exe (0x1248) 0x2718 InfoPath Forms Services Runtime - Data Connections 7tfk Medium Data adapter failed during OnLoad: The underlying connection was closed: Could not establish trust relationship for the SSL/TLS secure channel. 8600cd7c-b06c-4f05-9666-f9315a13d1dd

I look under "Trust Relationships" in Central Admin and I only see "local" listed. Do I need to import my cert that's tied to my domain? or am I missing something else.


1 Answer 1


SharePoint maintains it's own store of trusted root certificate authorities for use with it's own token service. Check out the technet blog post for more details:


  1. Open the SharePoint Management Shell to run the PowerShell commands.

  2. Get the ADFS root certificate: a. $root = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2("c:\ADFSRoot.cer")

  3. Add the certificate to the list of trusted root authorities: a. New-SPTrustedRootAuthority -Name "ADFS Token Signing Root Authority" -Certificate $root

  4. NOTE: You must do this (with a separate name for the SPTrustedRootAuthority) for EVERY certificate in the root. For example, if you use a domain certificate authority and have it issue a certificate that you use for token signing, then you must follow steps 2 and 3 for both the issued certificate as well as the root certificate.

  • For anyone who doubts whether or not you have to add EVERY certificate in the chain, YOU DO. Yes, you are correct in understanding by thinking that this shouldn't be necessary, but SharePoint fails to implement SSL correctly, and does not download Issuer certs when it is requested. You must manually provide them.
    – Nacht
    Commented Jun 18, 2013 at 5:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.