Internally FIM/MIM Certificate management has 5 service accounts. 3 of these accounts have certificates stored within their personal certificate store on your application server. Each certificate uses a unique template that was created during the installation of the application. As with all certificates, they do eventual expired (based on the settings in your template).
The 3 accounts that have certificates are the Key Recovery Agent, the Enroll Agent, and the CLM agent accounts. If you are unsure of what accounts are which, go to this folder \Program Files\Microsoft Forefront Identity Manager\2010\Certificate Management\web on your CM server and open the web.config file. Look for the section that is labelled "CLM users" and find the entries with CLM.RecoveryAgent.Username, Clm.EnrollAgent.Username, and CLM.Agent.Username. Keep this file open as we need to make changes to it later.
Once you have the accounts identified, ensure you have the correct password for the account. You can test them using ldp.exe. If you don't have the password, first go through the password reset process.
With each of the accounts, you will need to open MMC doing a runas. Open one for each of the three accounts. Add the certificates snapin with the Current User option. Expand this, expand personal, and click on certificates. Unless you have gone through several certificates already, there should only be one in there.
Identify the key that you want to replace, and do an export of each one. Select PCKS#12 format with "include all certificates in the certificate path if possible" and "export all extended properties" options. Set a password and export to a file. This will give you a backup of the key just in case you need it again.
If you read the second article linked above, you will see that the CLMAgent key needs to be renewed with the same key, otherwise it will break previously issued smartcards. So you can do a renewal of the existing certificate by right clicking the certificate -> all tasks -> advanced operations -> renew this certificate with the same key. Click next/enroll/finish. You can do this for each of the 3 certificates. Once you have the new certificate (you will see an updated expiration date), open the certificates, go to the details tab, find the thumbprint value and make a copy of each new certificate's thumbprint.
Note: when copying the thumbprint value, you will end up with some invisible unicode character at the beginning of the string. Paste the thumbprint to notepad, go to the start of the string and hit Del once. This should get rid of it. Remove all spaces between the hex values. To validate that the special char has been removed, copy and paste the whole string into a command prompt and look for any box shaped character. If there are none, then the string is properly cleaned up.
Once you have all certificates renewed, and your thumbprints gathered, go to the web.config file for the CM application.
Look for Clm.SigningCertificate.Hash. Replace the current value with the new thumbnail of the ClmAgent certificate
Look for Clm.ValidSigningCertificate.Hashes. Add the new thumbnail of the ClmAgent certificate to this as a comma seperated list.
Look for Clm.SmartCard.ExchangeCertificate.Hash. Replace this with the ClmAgent certificate hash.
Search for Clm.EnrollAgent.Certificate.Hash. Replace this with the EnrollAgent certificate hash.
Go to your certificate authority server. Open the certificate authority utility, rightclick the CA name, open properties. Look for the policy module tab, click properties. Go to the signature certificates tab. Add a new hash and enter the ClmAgent thumbnail here. Restart certificate services.
On your CM server, run IISRESET.
If you use recovery agent's, follow the additional steps mentioned in the first link above.
No comments:
Post a Comment