Renewing High-Trust Certificate

Table of Contents

The following article describes the steps needed to register a new self-signed certificate for communication between KanBo and SharePoint (high-trust certificate). Please follow these instructions if your old self-signed certificate has expired.

Step 1: Generate and export a new self-signed certificate

  1. Open the IIS Server Manager.
  2. Right-click on your server and select Server certificates.
  3. From the menu on the right, select Create self-signed certificate.
  4. Give your certificate a name, and follow the steps to create it.
  5. After creating the certificate, save it to a file by following these steps:
  • Select Export. Follow these steps to save the file as a .pfx in the chosen location. We will use this location later when configuring the app.
  • Select View > Details > Copy to file. Save it as a .cer file in the same location as the .pfx file.
  • Install the certificate in the local machine store by double-clicking it. Then, ensure the certificate exists under the Personal tree using Manage Computer Certificates (certlm).

Step 2: Remove the old SharePoint certificate

To remove the old certificate, launch the SharePoint Management Shell. Replace the placeholders in {} with your data, and follow the order of the commands.

Get-SPTrustedRootAuthority
Remove-SPTrustedRootAuthority -Identity {id of the KanBo high certificate form the results
from previous command}
Get-SPTrustedSecurityTokenIssuer
Remove-SPTrustedSecurityTokenIssuer -Identity {id of the KanBo high certificate
from previous command}

You can check the result in the Central Administration > Security > Manage High Trust.

Step 3: Register the new certificate in SharePoint

You can now register the certificate in SharePoint. Replace the placeholders in the brackets {} with your data.

$publicCertPath = "{the path to your self-signed certificate .cer file ex. c:\certs\cert.cer}"
$issuerID = "{Issuer ID from appsettings.json}"
$authorityName = "{Your chosen authority name ex. KanBoServerAppsCerts}"
$certificate = Get-PfxCertificate $publicCertPath
New-SPTrustedRootAuthority -Name $authorityName -Certificate $certificate
$realm = Get-SPAuthenticationRealm
$fullIssuerIdentifier = $issuerId + '@' + $realm
New-SPTrustedSecurityTokenIssuer -Name $authorityName -Certificate $certificate -RegisteredIssuerName $fullIssuerIdentifier -IsTrustBroker
Iisreset

Step 4: Update KanBo configuration

If your organization uses a local certificate configured in appSettings instead of the signer attribute in the authentication section, make the following change to the web.config file.

If your KanBo is older than version 2.7.6:

  1. Remove or comment out the following entry:
    key=”thumbprint” value=”{Thumbprint}” store-name=”my” store-location=”localmachine” valid-only=”false” />
  2. Replace it with:
<signer type="X509SignerFromFile" file="{C:\certs\yourcertname.pfx}" key="{CertificatePassword}" />

If your KanBo is newer than version 2.7.6:

  1. Remove or comment out the following entry:
    key=”thumbprint” value=”{Thumbprint}” store-name=”my” store-location=”localmachine” valid-only=”false” />
  2. Replace it with
  <signer type="x509-file" file="{PathToPFXCert}" key="{PassForCert} />

Was this article helpful?

Please, contact us if you have any additional questions.