---
title: "Replace a Sitecore client certificate in Azure"
slug: "replace-a-sitecore-client-certificate-in-azure"
abstract: "How to replace a Sitecore client certificate in Azure."
---
# Replace a Sitecore client certificate in Azure

XP service roles require client certificates, known as private certificates in Azure. If a client certificate expires, you must replace the certificate and update all references to that certificate.

<details>
<summary><h2>Replace the certificate</h2></summary>

To replace an expired certificate:

1. In the Azure Portal, click the **TLS/SSL settings** option, click the **Private Key Certificates** tab, and click **Upload certificate**:

    ![IS USED 1-1.png](<https://doc.sitecore.com/api/markdown-image/xp/en/developers/91/platform-administration-and-architecture/images/IS%20USED%201-1.png>)

2. Upload your certificate (a `*.pfx` file).
3. Ensure that the uploaded certificate is healthy:

    ![IS USED 2.png](<https://doc.sitecore.com/api/markdown-image/xp/en/developers/91/platform-administration-and-architecture/images/IS%20USED%202.png>)

4. Copy the value of the **Thumbprint** column.
5. Navigate to the **Configuration** tab, change the **WEBSITE_LOAD_CERTIFICATES** app setting to use the copied thumbprint of the new certificate.

    ![IS USED 3.png](<https://doc.sitecore.com/api/markdown-image/xp/en/developers/91/platform-administration-and-architecture/images/IS%20USED%203.png>)

6. To apply the changes, click **Save**.

</details>

<details>
<summary><h2>Update the certificate thumbprint</h2></summary>

Roles that expose a web service reference the certificate thumbprint. To update the certificate thumbprint:

- Replace the value of the `validateCertificateThumbprint` key in the `<wwwroot>\App_Config\AppSettings.config` file:

    ```xml
    <?xml version="1.0" encoding="utf-8"?>
    <appSettings>
      <add key="validateCertificateThumbprint" value="31163F08D549CBD401BFFA83D6B7C5074971BACC" />
    </appSettings>
    ```

    This step must be performed on the following roles:

    - [xConnect Collection Search service](https://doc.sitecore.com/xp/en/developers/91/platform-administration-and-architecture/xconnect-collection-search-service.html "xConnect Collection Search service")
    - [xConnect Collection service](https://doc.sitecore.com/xp/en/developers/91/platform-administration-and-architecture/xconnect-collection-service.html "xConnect Collection service")
    - [Reference Data service](https://doc.sitecore.com/xp/en/developers/91/platform-administration-and-architecture/reference-data-service.html "Reference Data service")
    - [Marketing Automation Operations service](https://doc.sitecore.com/xp/en/developers/91/platform-administration-and-architecture/marketing-automation-operations-service.html "Marketing Automation Operations service")
    - [Marketing Automation Reporting service](https://doc.sitecore.com/xp/en/developers/91/platform-administration-and-architecture/marketing-automation-reporting-service.html "Marketing Automation Reporting service")
    - [Sitecore Cortex Processing Table Storage service](https://doc.sitecore.com/xp/en/developers/91/platform-administration-and-architecture/sitecore-cortex-processing-table-storage-service.html "Sitecore Cortex Processing Table Storage service")
    - [Sitecore Cortex Processing Blob Storage service](https://doc.sitecore.com/xp/en/developers/91/platform-administration-and-architecture/sitecore-cortex-processing-blob-storage-service.html "Sitecore Cortex Processing Blob Storage service")
    - [Sitecore Cortex Reporting service](https://doc.sitecore.com/xp/en/developers/91/platform-administration-and-architecture/sitecore-cortex-reporting-service.html "Sitecore Cortex Reporting service")

### Support self-signed certificates

To support self-signed certificates:

1. Set the `AllowInvalidClientCertificate` setting to `true` in the `<wwwroot>\App_Config\AppSettings.config` file for all XP service roles where this setting exists.
2. Set the `AllowInvalidClientCertificate` setting to `true` in the `<wwwroot>\App_Config\AppSettings.config` file for all Core roles where this setting exists.

</details>

<details>
<summary><h2>Update connections strings</h2></summary>

Roles that connect to a web service such as xConnect Collection include a certificate connection string. That connection string includes a thumbprint, which must match the `validateCertificateThumbprint` setting of the service. The following example shows the `xconnect.collection` connection string and the matching `xconnect.collection.certificate` connection string.

```xml
<add name="xconnect.collection" connectionString="https://tut4xconnect.dev.local" />
<add name="xconnect.collection.certificate" connectionString="StoreName=My;StoreLocation=LocalMachine;FindType=FindByThumbprint;FindValue=5496B9D84850AFE5A3554B7B2D23F3B5C79CA53A" />

```

To update connection strings:

1. Update certificate connection strings for all [XP service roles](https://doc.sitecore.com/xp/en/developers/91/platform-administration-and-architecture/roles-overview.html "Roles overview"). Refer to individual role pages for a complete list of certificate connection strings.

    > [!note]
    > Your implementation might not include the complete list of certificate connection strings. If this is the case, update the ones that do exist.

    - For all web services, connection strings are configured in `<wwwroot>\App_Settings\ConnectionStrings.config`
    - For the Marketing Automation Engine, connection strings are configured in `<wwwroot>\App_Data\jobs\continuous\AutomationEngine\App_Config\ConnectionStrings.config`. The `<wwwroot>` is either the Marketing Automation Operations web service (XP Scaled) or the standalone role that combines all XP Services (XP Single).
    - For the Processing Engine, connection strings are configured in `<wwwroot>\App_Data\jobs\continuous\ProcessingEngine\App_Config\ConnectionStrings.config`. The `<wwwroot>` is either the Processing web service (XP Scaled) or the standalone role that combines all XP Services (XP Single).
2. Update certificate connection strings for all [Core roles](https://doc.sitecore.com/xp/en/developers/91/platform-administration-and-architecture/roles-overview.html "Roles overview"). Connection strings are located in `<wwwroot>\App_Config\ConnectionStrings.config`.

</details>

<details>
<summary><h2>Troubleshooting</h2></summary>

You might see the following exception in the logs after updating a certificate, where `83DCC21BBF54D76F71D7B67EA2319273BCDA8E19` is the thumbprint of the old certificate:

```text
Message: The certificate was not found. Store: My, Location: CurrentUser, FindType: FindByThumbprint, FindValue: 83DCC21BBF54D76F71D7B67EA2319273BCDA8E19, InvalidAllowed: True.

```

To resolve the issue, restart the web application(s).

</details>