How to renew inventory server certificate

Snowrj asked a question.

May 30, 2019 at 7:00 AM

We are unable to see any site in IIS for snow inventory then How to bind new certificate?

Portal User
7 years ago
Hello Rameejraja, Correct, the Inventory Server does not have a site in IIS. The smoothest way to change the certificate is to run a few command line commands to swap the binding. ( Copied from the Inventory Server User Guide ) : To remove existing bindings: > netsh http delete sslcert ipport=0.0.0.0:443 To add new bindings: > netsh http add sslcert ipport=0.0.0.0:443 certhash=ABCD... appid={...} Here's a step by step: 1. Note and export existing settings in: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HTTP\Parameters\SslBindingInfo The <ip>:<port> parameter is typically used with the unassigned IP address 0.0.0.0 but can be used to bind to a specific interface as well. However, the port has to be unique and you can only have a single certificate hash bound to a specific port. 2. Stop "Snow Inventory Server 5" service 3. Remove existing bindings in elevated cmd promt: > netsh http delete sslcert ipport=0.0.0.0:443 4. To add new bindings: > netsh http add sslcert ipport=0.0.0.0:443 certhash=ABCD... appid={...} - Where certhash is equeal to thumbprint found on details view on certificate. - Where appid is equal to old appid found in the registry export done in step 1. 5. Start the snow inventory server 5 service again.
Expand Post
- Snowrj
  7 years ago
  Thanks Martin That was really helpful
  Expand Post
  - Snowrj
    7 years ago
    How to find APPID in certificate ?
    Expand Post
    Portal User
    7 years ago
    Hi Rameejraja, If you already have a certificate registered from when you installed the inventory server you will find the app ID in the registry at this location: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HTTP\Parameters\SslBindingInfo\--ip and port of your inventory server--
    Expand Post
Portal User
7 years ago
Another method is to use the snowserverconfig.exe to stop and remove the master server instance and then add it back again. This will let you go through the installation wizard again, that lets you select the new certificate. The database will be left untouched, but you need to save a copy of your current snowserver config file to make sure that any changes you made to it is transferred to the new config. You will also need the SQL connection properties so you can reconnect to the database.
Expand Post
- Snowrj
  7 years ago
  I tried this one too good
  Expand Post
- Joe665
  6 years ago
  hi, i ve tried that solution and now the i cannot install the master service new. i always get an error if i create the service.
  in the setup log i get this message:
  <RunException>
       <Type>System.ComponentModel.Win32Exception</Type>
       <Message>A specified logon session does not exist. It may already have been terminated</Message>
       <StackTrace>  at SslCertBinding.Net.CertificateBindingConfiguration.<>c__DisplayClass3.<Bind>b__2()
    at SslCertBinding.Net.HttpApi.CallHttpApi(Action body)
    at SslCertBinding.Net.CertificateBindingConfiguration.Bind(CertificateBinding binding)
    at SnowSoftware.Inventory.Server.Setup.SetServerSslConfigurationSetupTask.Run(XElement taskOut)
    at SnowSoftware.Inventory.Server.Setup.SetupEngine.Run()</StackTrace>
     </RunException>
     <CompensatingTransactionException>
       <Type>System.ComponentModel.Win32Exception</Type>
       <Message>The system cannot find the file specified</Message>
       <StackTrace>  at SslCertBinding.Net.CertificateBindingConfiguration.<>c__DisplayClass7.<Delete>b__6()
    at SslCertBinding.Net.HttpApi.CallHttpApi(Action body)
    at SnowSoftware.Inventory.Server.Setup.SetServerSslConfigurationSetupTask.CompensatingTransaction()
    at SnowSoftware.Inventory.Server.Setup.SetupEngine.RunCompensatingTransactions(List`1 runTaskList)</StackTrace>
     </CompensatingTransactionException>
  
  If i do this manually i get the message :
  A specified logon session does not exist. It may already have been terminated
  
  What can i do ?
  
  Greetings
  Joe
  Expand Post
  Unknown file type
  The file is no longer available.
  - vladimirsp
    6 years ago
    Hi!
    Did you resolve this issue ? I`m interested in the solution because I had something similar using SSL, but when we tried to use http - no problem.
    
    Best regards,
    Vladimirs
    Expand Post

Related Product Forums

→ Flexera One

→ Snow Atlas

→ FlexNet Manager

→ Snow License Manager

→ App Broker

Need help finding an answer?

Ask a Question →