Regarding Certificate Renewal

Hi all,
i am using sun java communication suite 5 + portal server 7.1.
My Webmail and Application Server is using the same certificate which will expire soon. If I can get any information about the certificate renewal.
regards
Adeel

Hi,
Try it with the new license page:
<a href="http://service.sap.com/sap/bc/bsp/spn/minisap/minisap.htm">http://service.sap.com/sap/bc/bsp/spn/minisap/minisap.htm</a>
For the old-style license key (license string) choose <b>NSP - SAP NetWeaver 04</b>.
For the new license key (license file) choose <b>NSP - SAP NetWeaver 2004s</b>
Hope this helps.
Kind regards,
Klaus

Similar Messages

J2EE Certificate Renewal in PI 7.0

Hi
We are executing a project to renew the certificates installed in our XI server. The certificate which is currently installed in our XI severer is signed by Verisign. All partners communicating to the XI server use the certificate to digitally sign the message. In XI server we have configured communication channels to receive process the signed message and also to deliver digitally signed message to partners. The validity of the current certificate installed in our system is going to end by the end of Feb. We are looking at renewing the certificate before the expiry date so that there will not be any interruption in partner communication. In this regard, please provide your inputs to the following items
1. Should the existing CSR be sent to the CA for validity extension or a new CSR to be generated
2. During certificate renewal, can the existing private/public key be retained for the renewed certificate
3. Can we have the old certificate installed in the XI server along with the newly renewed certificate, so that the partners can be gradually migrated
4. Is XI server restart required after certificate installation/upgrade
We have referred the SAP Note 694290 for Verisign certificate renewal
Thanks
Srinivas

No cross posting
Read the "Rules of Engagement"
Regards
Juan

Cisco ISE Admin and EAP certificate renewal

Hi board,
maybe I'm asking a rather dumb question here, but anyway :)
I'm currently thinking about how to renew an admin/EAP certificate on an ISE node and the effect on the endpoint authentication.
Here's the thing I do, when I initially install an ISE node
1.) CSR creation on ISE (PAN) - CN=$FQDN$ and SAN="fqdn as well"
2.) Sign CSR and bind certificate on ISE node - done
Now after 10 month or so (if the certificate is valid for one year) I want to renew the ISE admin/EAP certificate.
CSR creation: I cannot use the $FQDN$ as the CN, because there is still the current certificate (CN must be unique in the store, right?)
So what to do now? Do I really need to create a temporary SSC and make it the admin/EAP certificate, delete the current certificate and then create a new CSR? There must be a better and more important non-disruptive way of doing this.
How do you guys do this in your deployments?
Thanks in advance and sorry again if this is a silly question.
Johannes

you can install a new certificate on the ISE before it is active, Cisco recommends that you install the new certificate before the old certificate expires. This overlap period between the old certificate expiration date and the new certificate start date gives you time to renew certificates and plan their installation with little or no downtime. Once the new certificate enters its valid date range, enable the EAP and/or HTTPS protocol. Remember, if you enable HTTPS, there will be a service restart
Certificate Renewal on Cisco Identity Services Engine Configuration Guide
http://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/116977-technote-ise-cert-00.html

Exchange 2007 Webmail certificate Renewal

Hi,
If any one knows more details about how to renew the webmail certificate in Exchange 2007, Webmail certificate is ging to expire soon ...EventID 12018

You can use powershell cmdlet Import-ExchangeCertificate to renew the certificate.
To enable the certificate, execute Enable-ExchangeCertificate -Services IMAP,POP,IIS,SMTP -Thumbprint <cert-thumbprint-here>
For more info, visit
https://www.digicert.com/ssl-certificate-renewal-exchange-2007.htm

Customizing Certificate Renewal

We are developing system that makes use of Certificate Server. But, only our system is visible form the Internet,
CS is hidden behind the firewall.
We've developed a solution, that makes it possible to request for certificate from our system, then forwards the request to CS, and vice versa, we fetch the page which installs the certificate and forwards it to end-user.
But, when talking about renewal, we have a problem.
CS interface for certificate renewal expects, that user legitimates with its expiring (or expired) certificate and then
CS regenerates new certificate (with validity customized via console) and installs it on client browser.
We expected similar functionality as with requesting for certificate. User fills out the request, sends it to CS, and admin after checking issues the certificate. More, the admin is responsible for renewing the certificate, not the user, as in previous scenario.
Also, authenticating with client certificate makes it impossible to forward the request and response by us (we cannot fetch the certificate from the user browser to use it for communication with CS)...
Maybe some of You have solution that satisfies our needs?
Maybe CS has another interface, which we didn't explore, allowing certificate renewal without presenting user certificate.
Or you developed your own, custom solution, that can be suitable for us...
Thanks for help!
Michal Szklanowski
Java Architecte
empolis Poland

You have to create certificate request(CSR) from the same instance on which you are trying to install the certificate.
You need to copy the production server's *.dbs in <ws-install-dir>/https-<instance>/config and run a pull-config --force command to pull the changes into Admin Server.
If you use WS7.0 Admin Server for certificate renewal, AFAIK a new set of private and public key is generated.

Regarding CCNP certificate renew

I have CCDP exam 642-874: Designing Cisco Network Service Architectures cleared. Now my CCNP certification is going to expired on 19th may. If I would attentd the CCDA to complete the path of CCDP .. Will that renew my CCNP level certificate for next three years?

Ok..will do it... I logged a query with cisco they are saying I suppose to get soft copy !
Posted by WebUser Rajdeep Parmar from Cisco Support Community App

Certificate Services: CA-Xchg certificate renewal ignoring configuration settings

Hi
I'm seeing a problem with CA-Xchg renewal and I'm hoping someone can help. This is on w2k3 r2 SP2 CA machine that's attached to an HSM.
The first time the CA issues itself the CA-Xchg certificate, it used all the correct settings (key length=2048, EncryptionCSP=<HSM vendor>, etc). The CA-Xchg certificate & keys are in the HSM so everything is fine.
However, all other CA-xchg certificates since the very first one, now completely ignore the configured registry settings on the CA. These renewed CA-Xchg certificates keep the public/private keys locally on the OS and use a smaller key length (1024).
This behavior was not seen in previous testing.
The CRLFlag CRLF_USE_XCHG_CERT_TEMPLATE is not configured. as a precaution the CA exchange template has the same key length And CSP settings as the CA's registry (even though these settings are ignored if using the CA exchange template).
The strangest thing is that the CA is still happily using/accessing it's CA keys in the HSM when signing certificates, publishing CRLs, etc, so it's not an "access to the HSM" problem. That and the very first CA-xchg certificate used the HSM fine.
The CA is being used to issue certs for CLM so the CLM policy and exit modules are installed. I don't think this is doing anything as the policy module is configured to pass all non-CLM cert requests to the windows default policy module.
is there some sort of "hard wired" default setting the this CA is reverting back to (for whatever reason) instead of what is configured in the registry?
Setting the KRAFlag KRAF_DISABLEUSEDEFAULTPROVIDER isn't an option as that flag was added with 2008. it's not available in 2003
any help, ideas, etc, is much appreciated
cheers
Todd

Hi,
Thank you for your question.
I am trying to involve someone familiar with this topic to further look at this issue. There might be some time delay. Appreciate your patience.
Thank you for your understanding and support.
TechNet Subscriber Support
If you are
TechNet Subscription
user and have any feedback on our support quality, please send your feedback
here.
Regards, Yan Li

Portal certificate renew

Hi All,
Need your help urgently.. i need to how to renew the system pse certificate... can we generate a new certificate in portal itself??

Hi,
first of all: what certificate are you talking about? From the replys you got you could see that we went in different directions. Are you talking about the SSL certificate (used for a secure connection to the portal) or the verify.der (used for SSO to backend systems).
You won't get a warning message for either. In the SSL case you will simply get a security pop-up when accessing the portal saying that the certificate is no longer valid.
In the SSO case SSO will simply stop working.
I hope with the replys mentioned above you are able to create new certificates. If not, please come back and explain your situation in more detail.
Regards,
Holger.

Poratal certificate renewal

Hi,
In my BW system the existing portal certificate is expired today.Can anybody please tell me how to renew the portal PSE certificate in BW system.
Could you please explain this with steps.
Regards,
SA.

Hi
This is the normal process to upload portal certificate to backend.
Yuo can try this
- Download the certificate from the portal: logon to the Portal with an admin account and navigate to System Administration u2013 System configuration u2013 choose Keystore administration in the left pane u2013 choose download verify.der file u2013 save file locally. Since this is a zip-file you have to unpack it first.
- Logon in the abap system and start transaction STRUSTSSO2 u2013 navigate to certificate u2013 import and upload verify.der as a binary file.
- The cerficate is visible in the cerficate-frame, now add the certificate to the certificate-list using the pushbutton
- Add certificate to the ACL list using corresponding pushbutton, fill in System ID and client
- Save the configuration
- Restart ICM using SMICM u2013 administration u2013 ICM u2013 exit soft.
make sure to restart the ICM on every application server

WINRM HTTPS listener and Certificate renewal

hello,
I am planning to setup winrm over HTTPS only on multiple 2008R2 systems.
All computers are joined to same domain and are configured to request/renew computer certificate from local CA (via GPO).
When setting up winrm listener over HTTPS, it creates ok with current certificate thumbprint.
My question is, what happens to WINRM listener when computer certificate gets renewed (i assume it will have new thumbprint)? Would i need to recreate listeners everytime that happens? Can't imagine managing this in large environments where different
computers renews certs at different time.... Whats your approach in this situation?
thanks in advance for all answers!

Hi,
The purpose of configuring WinRM for HTTPS is to encrypt the data being sent across the wire.
WinRM HTTPS requires a local computer "Server Authentication"
certificate with a CN matching the hostname, that is not expired, revoked, or self-signed to be installed. So I think after the cretificate gets renewed, the
WINRM listener will have a new certificate too.
Regards,
Yan Li
Regards, Yan Li

Verisign Certificate Renewal - Help!!!

Hi Guys,
     I am a beginner in Adobe Flex.
     The digital certificate from verisign got expired which I used in my flex builder 3, packaging it while exporting an AIR application.
     My organisation renewed it and gave me a certificate .p12 file stating that it is a renewed one.
     I used that renewed file in place of the old .p12 file in the application package and exported it to an AIR application.
     But, I was not able to install that application anymore as it results in "The installation of this application is damaged. Try re-installing the application or contact the publisher for assistance." error.
     Later, I double clicked that .p12 file and registered it with trusted enterprise certificates. Now the application installed fine. But it did not work in another PC. Later It worked when I did the same process in that PC also(i.e. I double clicked that .p12 file and registered it with trusted enterprise certificates in that PC).
     In that process I found that the previous certificate was "VeriSign Class 3 Code Signing 2009-2 CA" and the renewed one is "VeriSign Class 3 Code Signing 2010 G5". Is this the reason???
     Or am I doing something wrong while exporting the release build???? Somebody please help me ASAP.
     FYI - I am using this verion SDK "<application xmlns="http://ns.adobe.com/air/application/1.5">" in my app.xml file.
Thanks & Regards,
Raj
Message was edited by: TomCruise06

What do you mean by "Call" a certificate? A certificate is not "called". It is a container for an asymmetric cryptographic key. What you normally do with the certificate is "extract" the key so that you can use it
for a cryptographic operation. In .Net, you typically use the classes in System.Security.Cryptography to do this. See example here:
http://www.ultradevelopers.net/Blog/21

Federation trouble with some partners after public certificate renewal

I always seem to find the answer to my problems on this Forum , but this time im stuck and need a little help.
Problem happened after i renewed public certificate on Lync Edge server. Instantly discovered federated partners dropped from 13 to 3. I get presence unknown with the "undiscovered" partners.
I also got same problem with 2 out of 5 direct/enhanced federated partners.
Lync mobile ”Push Notifications” also stopped working.
I updated the certificate 29.october. Since then discovered partners has increased to 7, Lync Mobile ”Push Notifications” started working after avout 2 weeks, but I’m still missing federation with a couple of important partners,
and i still dont have federation working with partners using Lync Online (sipfed.online.lync.com). I do however never lost the federation with MSN contacts.
Looking through the Edge server Event Viewer , I do see alot of ”LS Protocol Stack” – Event id 14502
A significant number of connection failures have occurred with remote server sip.sarpsborg.com IP xx.xx.xx.xxx. There have been 289 failures in the last 880 minutes. There have been
a total of 6516 failures.
The specific failure types and their counts are identified below.
Instance count
- Failure Type
6095
0x80072746(WSAECONNRESET)
421
0x8007274C(WSAETIMEDOUT)
This can be due to credential issues, DNS, firewalls or proxies. The specific failure types above should identify the problem.
When I Run the “Microsoft Remote Connectivity Analyzer” it is all green except for small warning saying.
Analyzing the certificate chains for compatibility problems with versions of Windows.
Potential compatibility problems were identified with some versions of Windows.
Additional Details
ExRCA can only validate the certificate chain using the Root Certificate Update functionality from Windows Update. Your certificate may not be trusted on Windows if the "Update Root
Certificates" feature isn't enabled.
My Certificate is bought from highly respected certificate authority, and it was renewed with the same authority.
When logging from a client i get these errors.
ms-diagnostics:
1047;reason="Failed to complete TLS negotiation with a federated peer server";WinsockFailureCode="10054(WSAECONNRESET)";WinsockFailureDescription="The peer forced closure of the connection";Peer="sip.partnerdomain.com";Port="5061";source="sip.our.domain.no"
I looks to me like some of my previously federated partners dont like my new certificate, and that they basically need to update their root certificate.
I’m having a hard time establishing exactly what has gone wrong here.
Since I now have federation working with 7 partners, Lync Mobile is working with Push notifications and Microsoft Remote Connectitivity Analyser tells me Almost everything is fine.
Is there anything misconfigured at my installation, or anywhere i can look deeper?
Or…
Maybe my public Certificate Authoirty provided me with a certificate that’s ”too new”?
Or..
Maybe our federated partners havent updated their Root Server Certificates on their edge server in a while?
Can anyone help me point me in the right direction where i can look for more information?

Hi,Jorgen,
Did you run Test-CsFederatedPartner and see if it returns successful results?
Also please check the new certificate is located in the trusted cert store on your Lync server,if not please manually add it under the personal certificates and under trusted root certification authorities,then reboot the Lync server.
Here is an old thread with similar error message about the same failure type for your reference.
http://social.technet.microsoft.com/Forums/nl-NL/ocsedge/thread/f2f39c06-cb3a-456d-8578-ee2408116ebb
If still no luck please turn on Lync server logging and reproduce the issue to get the trace log for more specific information for troubleshooting.
Regards,
Sharon
Sharon Shen
TechNet Community Support
Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question.

SSL certificates renewal

Hello,
We have two loadbalanced messaging servers and SSL enabled for POP3/IMAP and SMTP. Our certificates are about to expire and need a renewal. I havent found a renewal procedure in the official sun documentation for this particular case. As far as I have learned, the CSR needs to be generated again (from one of the two physical servers) for both the popimap and Server-Cert certificates. Only two certificates are needed (popimap and Server-Cert) and not a certificate per physical server. The new certificates should be imported to one of the servers and the certificate database copied to the other one (with -A option to the certutil command). Could you please confirm this? Please advise.
Thank you and
BR,
Senka

senka wrote:
We have two loadbalanced messaging servers and SSL enabled for POP3/IMAP and SMTP.What version of Messaging Server are you running (./imsimta version)?
Our certificates are about to expire and need a renewal. I havent found a renewal procedure in the official sun documentation for this particular case.
As far as I have learned, the CSR needs to be generated again (from one of the two physical servers) for both the popimap and Server-Cert certificates.Why are you using two certificates?
Only two certificates are needed (popimap and Server-Cert) and not a certificate per physical server.A certificate is needed for each "host" that the client will see. So if the client connects to "mail.mydomain.com" which translates the load-balanced front-end IP address, then you will need a certificate for "mail.mydomain.com".
The new certificates should be imported to one of the servers and the certificate database copied to the other one.I suggest you use the same process to keep the certificate database files in sync that you used to install the certificates in the first place.
Regards,
Shane.

Certificate renewed, clients offered expired cert

Renewed our cert with GoDaddy, went into Server Admin and added the new one per instructions. Removed old cert and checked that all services are now using the new one. So far, so good.
Here's the fun part - the server is showing a two-year-old expired cert to OD users. This manifests itself as a dialog when launching iCal: "iCal can't verify the identity of the server example.com"
I seem to recall stumbling across a post somewhere regarding OD / LDAP where there were a few terminal commands required to complete the cert update.
Any clues?
Thanks!

UPDATE:
It appears to be some kind of Apache / Apache2 problem.... still digging.
Oddly, /etc/certificates now contains another group of 4 .pem files, which are directly referenced by servermgr_web_apache2_config.plist
These files were not here yesterday, and based on their date stamp, these are the expired cert files. I cannot assign the new cert in Server Admin, and I cannot edit the .plist manually. More precisely, I can edit the plist, but something keeps re-writing the old value back into the file. Server Admin will let me select the new cert, but when I attempt to save the change, I get this error:
More to come, I'm sure.
;o)

SBS2008 Self signed certificate renewal: Root CA not trusted by clients

Following the prompt from the Critical Event emails, namely:
Title: Leaf certificate expiring
Source: Networking - Certificate
Description: The certificate that is helping to secure your Web site traffic will expire in less than two weeks. Before then, run the Fix My Network Wizard from the Connectivity subtab on the Network page of the Windows SBS Console.
Now all the domain clients are popping-up certificate errors when launching outlook and get certificate warnings on internal access to RWW or OWA. Internal client access to the latter generates a warning about the Root CA certificate not being trusted
(the remote.domainname is OK). The Root CA has been created today as part of the FMNW (log shows this step). Running the certificate install package on the client solves this OK, but I thought that was unnecessary on domain joined machines?
I can push out the certificate via GPO to sort this, but would appreciate any feedback on whether this is "expected behaviour" from the FMNW
Thanks

Hi,
I’m glad to hear that you have resolved the issue and thanks for sharing your solution in the forum. This will help others who face the same scenario resolve the issue quickly. If there is
anything else I can do for you, please do not hesitate to let me know. I will be very happy to help.
Best Regards,
Andy Qi
TechNet Subscriber Support
If you are
TechNet Subscription user and have any feedback on our support quality, please send your feedback
here.
Andy Qi
TechNet Community Support

Regarding Certificate Renewal

Similar Messages

Maybe you are looking for