Directory Programming .NET

We have an upcoming Account Partner that wants to use an internal CA to provide their certificates for ADFS. How do I disable CRL Checking for ADFS for this Account Partner only?

Also, how do I import their CA certificate chain so that it is trusted?

I did find this: http://technet.microsoft.com/en-us/library/cc738754%28WS.10%29.aspx

However I have no idea what to do with this script, where to put it, where/when to run it, does it need to run over and over? Need to be integrated into the ADFS code? Need to run it just once? I don't get it.

I usually do this by manually changing the trust policy file and setting the setting that says "CheckChainExcludeRoot" to "None" for any specific configured partner that you want to disable this on. You also need to increment the trust policy version (which is near the top of the file) by one anytime you make a manual change. Edit the file with the mmc closed.

In Win2K8 ADFS v1, there is a setting in the UI for this but in 2K3 you must do this directly in the trust policy.

In ADFS v2, you have to do this with PowerShell. :)