--- title: "Upgrade Identity Server" slug: "upgrade-identity-server" abstract: "" --- # Upgrade Identity Server The upgrade of Sitecore Identity Server refers to the Sitecore XP Container Deployment Package corresponding to your current Sitecore XP version. For example, upgrading Identity Server in a Sitecore XP 10.5 deployment applies to the Sitecore XP 10.5 Container Deployment Package, or a more recent deployment package version if applicable. Similarly, the Identity Server upgrade instructions follow the same general deployment steps that are documented in the Sitecore XP Developer Workstation Deployment with Docker guide. The instructions below provide the additional steps specific to Identity Server. For example, a Sitecore XP 10.5 deployment uses this Developer Workstation Deployment with Docker guide as a reference. ## Prepare the Docker Compose specification files > [!note] > This step corresponds to Sitecore XP Developer Workstation Deployment with Docker guide *section1.3.3 - Run script to prepare for deployment*. Update the specification files to use Sitecore Identity Server 9.0.X. Starting with Identity Server 8.0, the name of container image has been changed from `sitecore-idX` to `sitecore-identity`. Its tag is now aligned with the version of the Sitecore Identity Server itself, for example: `sxp/sitecore-identity:9.0-ltsc2022`. For Sitecore XP 10.0 only, update the healthcheck probe for the 'id' service in the docker-compose.yml file from: ```docker ["CMD", "powershell", "-command", "C:/Healthchecks/Healthcheck.ps1"] ``` to: ```docker ["CMD", "pwsh", "-command", "C:/Healthchecks/Healthcheck.ps1"] ``` ## Encrypted Communication with SQL Server > [!note] > Applicable only to upgrades from Identity Server versions prior to 8.x. Starting from version 8.0, Sitecore Identity Server requires encrypted communication with SQL Server by default. This change is due to the adoption of a newer version of `Microsoft.Data.SqlClient` that enforces stricter security measures, as described in [Microsoft’s Breaking changes in EF Core 7.0](https://learn.microsoft.com/en-us/ef/core/what-is-new/ef-core-7.0/breaking-changes?tabs=data-annotations%2Cv7#encrypt-true) article. Follow these steps to configure and implement an encryption certificate: > [!note] > You may use the latest Sitecore XP Container Deployment Package as an example. 1. Obtain certificates for the encryption. Prepare two certificate files: - `mssql.pfx` - contains the private key and public certificate that will be used by SQL Server for encryption. - `RootCA.crt` - public certificate of the certification authority (CA) that issued the encryption certificate. These must meet specific requirements to be used with SQL Server. For more information, refer to the [Certificate requirements for SQL Server](https://learn.microsoft.com/en-us/sql/database-engine/configure-windows/certificate-requirements?view=sql-server-ver16) article. 2. Configure an encryption certificate for the SQL Server deployment. If your container deployment is using the `mssql-developer` image, you can use the latest version of this image that supports configuring the encryption certificate. Perform the following: :::lettered 1. Pull the latest version of the mssql-developer image, by running the following command: ```text docker pull scr.sitecore.com/sxp/nonproduction/mssql-developer:2022- ``` 2. Mount the certificate for encryption as a `c:\certs\mssql.pfx `file into the SQL Server container. 3. Set the following SQL Server container environment variables: - `NAME` – name of the SQL Server instance. - `TLS_CERTIFICATE_PASSWORD` – password for the certificate file If your deployment uses an image of the SQL Server with another name, create a custom image on top of the original one. It should perform an initialization similar to that of a stand-alone SQL Server. For more information, refer to Microsoft’s [Secure SQL Server Linux](https://learn.microsoft.com/en-us/sql/linux/containers/security?view=sql-server-ver16#encrypt-connections-to-sql-server-linux-containers) containers article. ::: 3. Ensure the certificate is trusted in the Identity Server deployment. Mount the CA certificate that was used to issue the encryption certificate as a `C:\certs\RootCA.crt` file into the Identity Server container, in the `docker-compose.yml` file. For example, if the certificate file is stored in the `compose///id/certs` folder, then the configuration should be: ``` id:   ...   volumes:     - type: bind       source: .\id\certs       target: c:\certs ``` 4. \[Optional\] Enforce Sitecore Identity Server to use an encrypted connection to SQL Server. In the `compose///docker-compose.yml` file, update the value of the `Sitecore_Sitecore__IdentityServer__SitecoreMemberShipOptions__ConnectionString` environment variable by appending the parameters:  ```yaml ...;Encrypt=true;TrustServerCertificate=false; ``` Alternatively, it is possible to use default self-signed encryption certificates which SQL Server generates at startup if custom certificates are not provided. This may simplify the installation process for non-production deployments, but this approach is **not recommended for production environments**. To accommodate this configuration in Sitecore Identity Server, it is sufficient to apply one of the following configuration changes to Docker Compose configuration: 1. To disable encryption: Update the value of the `Sitecore_Sitecore__IdentityServer__SitecoreMemberShipOptions__ConnectionString` environment variable by appending the parameter: ```yaml ...;Encrypt=false; ``` 2. Enable encryption but disable certificate trust validation. Update the value of the `Sitecore_Sitecore__IdentityServer__SitecoreMemberShipOptions__ConnectionString` environment variable by appending the parameter:      ```yaml ...;Encrypt=true;TrustServerCertificate=true; ``` For Sitecore XP 10.0 only, the only available option is to use the default self-signed encryption certificates generated by SQL Server. ## Run upgrade script on security database > [!note] > Apply this step in the Sitecore XP Developer Workstation Deployment with Docker guide *section 2 - Deploy a workstation*, after the images are pulled and containers are deployed. To run the upgrade script on security database: 1. Unpack the `Sitecore.IdentityServer.UpgradeScripts.9.0.zip` file. The package contains a database upgrade script `CMS_security_IdentityServer.sql`. The script applies changes to the Core database that are required for Sitecore Identity Server 9.0. 2. Execute the upgrade scripts against the Core database used in the deployment. For example, it can be done in the following way: ``` docker cp ./CMS_security_IdentityServer.sql :/CMS_security_IdentityServer.sql docker exec -it sqlcmd -S localhost -U -P '' -d -i ./CMS_security_IdentityServer.sql ``` You should now be able to log in to the CM server and log out without any errors displayed.