On our local and DEV environment (Sitecore 9.0.1 and Commerce 9) we need to replace the root certificate with a new one, therefore all "child" certificates need to be recreated and replaced. Is there a recommended way to do that or at least an approach.

Many thanks in advance.


I use these two PowerShell scripts to generate new certificates for Sitecore Commerce (if they was expired):

Generate SelfSignedCertificate for specific DnsName:

New-SelfSignedCertificate -FriendlyName "domain.dev.local" `
-DnsName "domain.dev.local" -CertStoreLocation "cert:\LocalMachine\My" `
-NotAfter (Get-Date).AddYears(10)

Generate new PfxCertificate:

$CertificateStore = "cert:\\Localmachine\\My"
$CertificateDnsName = "identity.server"
$CertificateFriendlyName = "Sitecore Identity Server"
$CertificatePassword = "sitecore"
$pfxPath = "c:\certificates\$CertificateDnsName.pfx"
$certificate = New-SelfSignedCertificate `
-Subject $CertificateDnsName `
-DnsName $CertificateDnsName `
-KeyAlgorithm RSA `
-KeyLength 2048 `
-NotBefore (Get-Date) `
-NotAfter (Get-Date).AddYears(10) `
-CertStoreLocation $CertificateStore `
-FriendlyName $CertificateFriendlyName `
-HashAlgorithm SHA256 `
-KeyUsage DigitalSignature, KeyEncipherment, DataEncipherment `
-KeySpec Signature `
-TextExtension @("{text}")
$certificatePath = $CertificateStore + "\" + $certificate.Thumbprint
$pfxPassword = ConvertTo-SecureString -String $CertificatePassword -Force -AsPlainText
Export-PfxCertificate -Cert $certificatePath -FilePath $pfxPath -Password $pfxPassword
Import-PfxCertificate -FilePath $pfxPath -CertStoreLocation $CertificateStore -Password $pfxPassword -Exportable

After that you need to replace manually thumbprints from old to new in all configs.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.