Certificates

Configure a new client certificate

If your client certificate has expired, you must configure Sitecore to use a new client certificate.

To configure Sitecore to use a new client certificate:

1. Install the new client certificate on every computer on which you have installed the xConnect client and ensure that the authority that issued the certificate is in the Trusted Authorities list.

   For more information about the appropriate role and the certificate that you must install, see the section Set up the certificates. 

2. To grant the appropriate permissions to the certificate, open the Microsoft Management Console, click File, and then click Add/Remove Snap-in.

3. In the Add or Remove Snap-ins dialog box, in the Available snap-ins field, select Certificates and then click Add.

4. In the Certificates snap-in dialog box, select Computer account and then click Next.

5. In the Select Computer dialog box, select Local computer and then click Finish.

6. In the Add or Remove Snap-ins dialog box, click OK.

7. In the Console window, in the left-hand pane, navigate to the Certificates (Local Computer)/Personal/Certificates folder.

8. In the center pane, right-click the new certificate, click All Tasks, Manage Private Keys.

9. In the Permissions dialog box, add the accounts that you want to grant permissions to, based on the following criteria:

   • For virtual accounts that were created for each Sitecore application pool identity, add for example:

     IIS AppPool\ – for virtual accounts.

     NETWORK SERVICE account – only if the Sitecore website application pools run under the NetworkService identity.

     LOCAL SERVICE account – the Marketing Automation Engine runs under this account.

   • For virtual accounts that were created for the xConnect application pool identity for the website hosting the xDB Automation Operations role, add for example:

     IIS AppPool\ – for virtual accounts.

10. In the \App_Config\connectionstrings.config file, in the appropriate connection strings, replace the old thumbprint parameter value with the new client certificate thumbprint.

11. Restart IIS on every computer that you configured to use a new client certificate.