Expired Workflow Manager Certificates

Question

Our Workflow Manager certificates are expired since Monday last week. Therefore our 2013 workflows, which we and our customers use a lot in our productive SharePoint environment, don't work anymore. I can't renew the certificates, because the Workflow Manager became unresponsive after the expiration date of the certificates. I tried accessing the configuration via the Workflow Manager executable, which just crashes on start and via PowerShell which prints out the following error: "Certificate requested with thumbprint ... not found in the certificate store". How can I update the certificates to get back to a working Workflow Manager?

One probable solution I found, is installing the CU4 for Workflow Manager 1.0 (https://support.microsoft.com/en-us/help/4019220/description-of-the-cumulative-update-4-for-workflow-manager-1-0) - one of the features added in this update is "Additional support for renewing the expired certificates used in Workflow Manager farm". Can I install an update to the Workflow Manager if the certificates are expired?

Are there any other solutions?

Answer 1

OK, you hit the same issue I have before, with WFM you need to replace the certs before they expire. You can either:

1.Rebuild WFM farm with new certs and use DR Restore method to get the old WFM farm data.

2.Do little hack. Basically you need a 3rd (intermediary) cert that will have validity that spans over your old and new cert. No one will backdate the cert for you. But you can trick the system with self signed cert you create on a machine with the clock turned back. (please note that I used that method only on the QA system, for PROD I would go with option 1)

Problem with Workflow Manager 2013 is that you cannot update the certificate if it is expired. You need to do it before it gets expired. So here is how you can do it. I have done it this way:

1. Move clock back on the server and create a new selfSigned certificate that spans across the old and new certificate.
2. The time on server will sync so you will need to change it again.
3. Change time (to time before original cert expired) and update the Workflow manager certificate to selfSigned.
4. Wait for time sync and change now the certificate to your new certificate