0

I have SharePoint 2013 Workflow Service auto generated certificates listed below in my single server SharePoint Farm and they all are expired now.

  1. AppServerGeneratedSBCA – Root Certificate for Service Bus
  2. FQDN.com –Service Bus Farm and Encryption Certificate
  3. FQDN.com – Workflow Manager Services and Encryption Certificate
  4. WorkflowOutbound – Workflow Manager Outbound Signing Certificate

I am following http://www.harbar.net/articles/wfm3.aspx article and enrolled the workflow service server in CA and created the new certificates, but still can't apply new certificates. As soon as I run Stop-SBFarm or Get-SBFarm commands, I always get the below error.

"Thumbprint not found in the certificate store LocalMachine\My"

Thumbprint in the above error is my expired certificate's thimbprint. I have verified and the expired certificate is still present in my server (mmc).

Updated I have tried to set the SharePoint server time back to the date where the certificates were not expired but Set-SBCertificate command is failing with the error as shown below.

enter image description here

If I try to request a new Certificate, it is throwing an error as shown below.

enter image description here

Please let me know if there is any step that I am missing or is there another way to renew expired certificates without changing the server time?

Improve this question
1

For expired certificates, change the time on the VM back to prior to the expiration, then following the certificate replacement procedure.

Improve this answer
4
  • Will changing time cause any problem with SharePoint? This is a production server so just want to make sure that this will not have any impact. Thanks – Crow Canyon Jul 2 '19 at 13:54
  • Yes, it will likely prevent the server from authenticating with Active Directory (due to >5 min clock skew). You should perform this during a downtime maintenance window as SharePoint will likely become inaccessible. – Trevor Seward Jul 2 '19 at 15:22
  • I have tried this, Stop-SBFarm command is succeed but now Set-SBCertificate command is throwing the error "Cannot validate argument on parameter 'FarmCertificateThumbprint'. A valid certificate corresponding to the supplied thumbprint is not present in localmachine\personal certificate store or could not be accessed. CategoryInfo:InvalidDate......". It looks like since the new certificate is generated after the expired date, when we set the old date, it cannot recognize the certificate create in future date. Is there any other way to renew expired certificates without changing the server time? – Crow Canyon Jul 4 '19 at 22:48
  • Hi Trevor, thanks for your response. I have updated the original content and added screenshots of the errors that I was referring to in my previous comment. – Crow Canyon Jul 5 '19 at 21:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.