Azure – How to install SSL Certificate into Service Bus 1.1 on Windows Server

azuressl-certificatewindows-server-2012

For test cases and evaluation we installed 2 nodes with "Azure Service Bus 1.1" on Windows Server 2012 R2 machines.

The installation process installs the https endpoints with a self-signed certificate which is not trusted through our domain.

In whitepapers I have red that there are two relevant certificates for Service Bus:
"Encryption Certificate" and "Farm Certificate". How can we change the certificate?

Best Answer

Use Set-SBCertificate command.

Example:

Set-SBCertificate `
  -EncryptionCertificateThumbprint ‎<thumbprint> `
  -FarmCertificateThumbprint ‎<thumbprint> `
  -SBFarmDBConnectionString "Server=sqlserver;Trusted_Connection=true;Database=SbManagement;Connect Timeout=300"

Also take a look at these blogposts:

Related Solutions

Windows – IIS no longer trusts any CAs for client authentication

I've faced the same problem, I finally figured out the site was working correctly, but was tricked by the openssl message (which is just negotiation)

The correct steps are:

Set IIS SSL bindings up correctly
netsh http show sslcert and copy the values
Overwrite server SSL certificate binding with netsh http update sslcert ipport=0.0.0.0:443 certhash=.... appid=.... sslctlstorename=ClientAuthIssuer clientcertnegotiation=enable (or netsh http delete followed with the netsh http add)
Verified that settings were applied with netsh http show sslcert
(Windows 2012 R2 only) Set HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\SendTrustedIssuerList to 1

The clientcertnegiotiation is needed to show the list to browsers/openssl, with it disabled a well configured client can still send the correct certificate.

Using CA Certificate for Remote Desktop – Secure RDP Connection Guide

The question you found that mentions using wmic to set the certificate thumbprint value should work without any additional feature installation. I asked and answered a similar question here with a little more detail. It also has a PowerShell equivalent for the wmic command. But I'll add some more explanation here as well.

Since you're already using this certificate for MSSQL SSL, I assume it's already installed into one of the certificate stores on the system. If you installed it in the context of a service account that MSSQL is running as, you might also need to install it into the Personal or Remote Desktop store for the "Local Computer" as well.
enter image description here

Once it's in there, you just need to update the SSLCertificateSHA1Hash value in Win32_TSGeneralSetting to point to it using one of the commands in my previous question.

If you want to check what the value is currently set to and compare it to the self-signed certificate, you can change the wmic command to the following. You can also use this to validate that the new thumbprint value you tried to set is correct.

wmic /namespace:\\root\cimv2\TerminalServices PATH Win32_TSGeneralSetting Get SSLCertificateSHA1Hash

The output should look something like this:
enter image description here

Best Answer

Related Solutions

Windows – IIS no longer trusts any CAs for client authentication

Using CA Certificate for Remote Desktop – Secure RDP Connection Guide

Related Topic