Encountered an error with AD FS 2.0 installed on Windows 2008 R2, after creating a new certificate and importing this.
The key was set to exportable, the service account had correct permissions, but still these errors appeared in the Event Log when restarting the AD FS service:
_There was an error in enabling endpoints of Federation Service. Fix configuration errors using PowerShell cmdlets and restart the Federation Service.
Additional Data Exception details: System.ArgumentNullException: Value cannot be null. Parameter name: certificate at System.IdentityModel.Tokens.X509SecurityToken..ctor(X509Certificate2 certificate, String id, Boolean clone, Boolean disposable) at System.IdentityModel.Tokens.X509SecurityToken..ctor(X509Certificate2 certificate) at Microsoft.IdentityServer.Service.Configuration.MSISSecurityTokenServiceConfiguration.Create(Boolean forSaml) at Microsoft.IdentityServer.Service.Policy.PolicyServer.Service.ProxyPolicyServiceHost.ConfigureWIF() at Microsoft.IdentityServer.Service.SecurityTokenService.MSISConfigurableServiceHost.Configure() at Microsoft.IdentityServer.Service.Policy.PolicyServer.Service.ProxyPolicyServiceHost.Create() at Microsoft.IdentityServer.Service.SecurityTokenService.STSService.StartProxyPolicyStoreService(ServiceHostManager serviceHostManager) at Microsoft.IdentityServer.Service.SecurityTokenService.STSService.OnStartInternal(Boolean requestAdditionalTime)_
During processing of the Federation Service configuration, the element ‘signingToken’ was found to have invalid data. The private key for the certificate that was configured could not be accessed. The following are the values of the certificate: Element: signingToken
Turns out AD FS 2.0 on Windows Server 2008 R2 doesnt’ warn you when using certificate with CNG private key like AD FS 3.0 on Windows Server 2012 R2 does (TechNet Article).
I re-enrolled for a certificate with CAPI1 private key, restartet the service, and voila! The service started successfully.
Microsoft could have provided us with a better error message there…