Certificates

Configure a new client certificate

If your client certificate has expired, you must configure Sitecore to use a new client certificate.

To configure Sitecore to use a new client certificate:

1. Install the new client certificate on every computer on which you have installed the xConnect client and ensure that the authority that issued the certificate is in the Trusted Authorities list.

   For more information about the appropriate role and the certificate that you must install, see the section Set up the certificates. 

2. To grant the appropriate permissions to the certificate, open the Microsoft Management Console, click File, and then click Add/Remove Snap-in.

3. In the Add or Remove Snap-ins dialog box, in the Available snap-ins field, select Certificates and then click Add.

4. In the Certificates snap-in dialog box, select Computer account and then click Next.

5. In the Select Computer dialog box, select Local computer and then click Finish.

6. In the Add or Remove Snap-ins dialog box, click OK.

7. In the Console window, in the left-hand pane, navigate to the Certificates (Local Computer)/Personal/Certificates folder.

8. In the center pane, right-click the new certificate, click All Tasks, Manage Private Keys.

9. In the Permissions dialog box, add the accounts that you want to grant permissions to, based on the following criteria:

   • For virtual accounts that were created for each Sitecore application pool identity, add for example:

     IIS AppPool\ – for virtual accounts.

     NETWORK SERVICE account – only if the Sitecore website application pools run under the NetworkService identity.

     LOCAL SERVICE account – the Marketing Automation Engine runs under this account.

   • For virtual accounts that were created for the xConnect application pool identity for the website hosting the xDB Automation Operations role, add for example:

     IIS AppPool\ – for virtual accounts.

10. In the \App_Config\connectionstrings.config file, in the appropriate connection strings, replace the old thumbprint parameter value with the new client certificate thumbprint.

11. Update the thumbprint values in all of the certificate connection strings on the following Sitecore instances:

    XP Scaled (XP1)
    Content Delivery
    Content Management
    Processing
    Marketing Automation Engine
    xDB Automation Operations

    For example, on each XP Single (XP0) Sitecore instance, update the thumbprint value in these connection strings:

    <add name="xconnect.collection.certificate" connectionString="StoreName=My;StoreLocation=LocalMachine;FindType=FindByThumbprint;FindValue=859E88DC0692BA1583145223C455F186937C0D62"
    />
    
    <add name="xdb.referencedata.client.certificate"
    connectionString="StoreName=My;StoreLocation=LocalMachine;FindType=FindByThumbprint;FindValue=859E88DC0692BA1583145223C455F186937C0D62"
    />
    
    <add name="xdb.marketingautomation.reporting.client.certificate"
    connectionString="StoreName=My;StoreLocation=LocalMachine;FindType=FindByThumbprint;FindValue=859E88DC0692BA1583145223C455F186937C0D62"
    />
    
    <add name="sitecore.reporting.client.certificate"
    connectionString="StoreName=My;StoreLocation=LocalMachine;FindType=FindByThumbprint;FindValue=859E88DC0692BA1583145223C455F186937C0D62"
    />
    
    <add name="xdb.marketingautomation.operations.client.certificate"
    connectionString="StoreName=My;StoreLocation=LocalMachine;FindType=FindByThumbprint;FindValue=859E88DC0692BA1583145223C455F186937C0D62"
    />

12. In the xConnect root folder, in the \App_Config\AppSettings.config file, update the thumbprint value in the following setting:

    <add key="validateCertificateThumbprint" value="859E88DC0692BA1583145223C455F186937C0D62" />

    You must update this setting on the following servers:

    XP Scaled (XP1)
    xConnect Collection
    XConnect Search
    xDB Reference Data
    xDB Automation Reporting
    xDB Automation Operations
    Sitecore Cortex Processing Engine
    Sitecore Cortex Reporting Service

13. Restart IIS on every computer that you configured to use a new client certificate.