Renew Expiring SB & WF Certs

Question

My service bus & workflow certificates (AppServerGeneratedSBCA) are expiring in Feb.

I have created 2 self signed certs and followed steps from: Changing my Workflow Manager Farm Certificates to replace the expiring certs.

Now, when I run Get-WFOutboundCertificate, it outputs with:

The underlying connection was closed, could not establish trust relationship for the SSL/TLS secure channel.

Is this the correct method to renew these certs? Or, how can I renew AppServerGeneratedSBCA instead?

Answer 1

There might be something wrong with you cert. Go to the windows event viewer, enable CAPI2 logs and retry the command. Inside CAPI2 logs you should get some more descriptive error. It may be the case that your machine config supports only TLS and your cert is SSL - or the cert chain is not trusted and you need to import it on the cert store. difficult to say more from the error you are sharing.

Answer 2

I followed the Harber's blog and newer had an issue. Make sure Certificate is properly issued and is in the cert store.

For Service Bus

# grab the certificate based on it's friendly name
$friendlyName = "wfmSanCert"
$cert = dir Cert:\LocalMachine\My | ? {$_.FriendlyName -eq $friendlyName}
# configure the certificates
Set-SBCertificate -FarmCertificateThumbprint $cert.Thumbprint -EncryptionCertificateThumbprint $cert.Thumbprint
# stop the service bus farm
Stop-SBFarm -Verbose
# update the service bus host(s)
Update-SBHost

For Workflow

# load up the Workflow Manager PoSh
Import-Module WorkflowManager
# grab the certificate based on it's friendly name
$friendlyName = "wfmSanCert"
$cert = dir Cert:\LocalMachine\My | ? {$_.FriendlyName -eq $friendlyName}
# configure the certificates
Set-WFCertificate -SslCertificateThumbprint $cert.Thumbprint -EncryptionCertificateThumbprint $cert.Thumbprint
# stop the workflow host
Stop-WFHost -Verbose
# update the workflow host(s)
Update-WFHost
# re-start the workflow host
Start-WFHost