Microsoft Workflow Manager and Microsoft Service Bus certificates expired on 31.10.2018.

The certificates themselves are no longer problem, these are easy to make. However, getting the Microsoft Service Bus and Microsoft Workflow Manager to use these is the challenge.

We updated Workflow Manager to CU4 (directly from CU2 and Service Bus 1.0), but then received error messages, when tried to enter a new certificate on Service Bus. No parameters were available via PowerShell on the Set-SBCertificate command.

We uninstalled all dependent software, as described in the following article:


(Only SbManagementDB and WFManagementDB databases were deleted because we want existing Workflows to be intact.)

Then reinstalled, configured and imported the data as recommended in such situations by following this article:


We have not been able to get it all working. Right now, it seems that we have received the newer version of Microsoft Service Bus (1.1) that does not want to fully play the Microsoft Workflow Manager that is required to run the recovery of existing databases. (It was the Web Platform Installer that installed 1.1. For us.)

Restore process has stopped at Restore-WFFarm. After that following was tried:

PS C:\Windows\system32> Get-SBNameSpace

SubscriptionId        : 00000000000000000000000000000000
State                 : Active
Name                  : WorkflowDefaultNamespace
AddressingScheme      : Path
CreatedTime           : 23/09/2014 13:17:05
IssuerName            : WorkflowDefaultNamespace
IssuerUri             : WorkflowDefaultNamespace
ManageUsers           : {[email protected], [email protected]}
DnsEntry              : 
PrimarySymmetricKey   : TY9o/3Pv67XXgGWLynwaq03nUpgTHSKrTRGCHkVweWwy6dMeQSWaE9+EsPj72vlm
SecondarySymmetricKey :  

PS C:\Windows\system32> Set-SBNamespace -Name WorkflowDefaultNameSpace -PrimarySymmetricKey TY9o/3Pv67XXgGWLynwaq03nUpgTHSKrTRGCHkVweWwy6dMeQSWaE9+EsPj72vlm
Set-SBNamespace : Cannot validate argument on parameter 'PrimarySymmetricKey'. Invalid primary/secondary symmetric key length. It should be 32 bytes long.

2 Answers 2


You wrote (Only SbManagementDB and WFManagementDB databases were deleted because we want existing Workflows to be intact.)

You cannot do that. You need to create a new WFFarm and perform Scope restore procedure. As in Disaster recover scenario.

All relevant information you will find here:


  • According to this article, we need to export the existing certificates, and import them in new farm. But in our case they have already expired.
    – WSWS
    Commented Nov 15, 2018 at 15:35
  • I think I had this situation and I created new farm with new certs and was still able to make a scope restore. I will try to check for notes and get back to you. Commented Nov 15, 2018 at 15:52
  • HI, did you find your notes?
    – WSWS
    Commented Nov 27, 2018 at 10:01
  • Sorry, unfortunately not. Commented Nov 30, 2018 at 13:40

There are several errors that can occur with restore-wffarm. To recreate a valid PrimarySymmetricKey do the following:

  1. Create new namespace: New-SBNamespace -Name 'namespaceTemp' -ManageUsers 'user1','user2' -verbose
  2. Copy the PrimarySymmetricKey from that namespace
  3. Update the default namespace to the PrimarySymmetricKey you just copied: Set-SBNamespace -Name WorkflowDefaultNamespace -PrimarySymmetricKey validKey
  4. Discard the temporary namespace: Remove-SBNamespace -Name 'namespaceTemp' After that you can run Restore-wffarm and will probably find one of the other errors :)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.