Updating certificate on scaled environment causes analytics error "The certificate was not found." [closed]

Question

Sitecore 10.3 with SXA 10.3 - Wildcard Certificate Issue with Analytics

I’m running a scaled setup on Sitecore 10.3, where:

• CM server has 4 xConnect roles.
• 2 CD servers.
• A separate server for the remaining xConnect roles.

Our wildcard certificate recently expired, so we installed a new one. Here’s what I did:

1. installed it on all the servers
2. set the private key permissions
3. updated the IIS bindings on all servers
4. updated the connectionstrings with the new thumbprint on all roles
5. restarted IIS on all servers

Everything works fine except Experience Analytics. The following error appears in the CMS logs when accessing the analytics board:

I keep getting the below error in my CMS logs whenever I open the Experience analytics board:

Exception Sitecore.XConnect.XdbCollectionUnavailableException: An error occurred while sending the request. ---> System.InvalidOperationException: The certificate was not found. Store: My, Location: LocalMachine, FindType: FindByThumbprint, FindValue: 432352ASAD3F5AESAMDSAO9930249A99DA1, InvalidAllowed: False.

The thumbprint in the error belongs to the expired certificate, which I have already removed from all servers and configurations.

I've already gone through every other question or article I found about this, I have tried so far the below several times:

1. Double checked all configs and identityserver have new thumbprint
2. New cert is installed correctly in LocalMachine's "Personal" store
3. Private key permissions are exactly the same as the old cert
4. Old cert is removed from all stores, Personal or CA
5. Restarted IIS, recycled app pools, restarted the xconnect services, restarted the servers themselves

Despite these efforts, the error persists.

Any suggestions or ideas for resolving this would be greatly appreciated!

Answer 1

It looks like you must have just missed updating a thumbrprint somewhere. The best bet would be to search from the root of every application for the old thumbprint 432352ASAD3F5AESAMDSAO9930249A99DA1. I use a program called total commander, which allows recursive searches for strings within files.

The most likely issue is one of the thumbprints within ConnectionStrings.config (on CM) or AppSettings.config (Collection or Collection Search).

Complete list of places to check below:

CM

ConnectionStrings.config

• xconnect.collection.certificate
• xdb.marketingautomation.operations.client.certificate
• xdb.marketingautomation.reporting.client.certificate
• xdb.referencedata.client.certificate
• xconnect.search.certificate
• cortex.processing.engine.certificate

Collection

App_Config/AppSettings.config

• validateCertificateThumbprint

Collection Search

App_Config/AppSettings.config

• validateCertificateThumbprint

Cortex Processing

App_Config/AppSettings.config

• validateCertificateThumbprint

App_Data/jobs/continuous/ProcessingEngine/App_Config/ConnectionStrings.config

• xconnect.collection.certificate
• xconnect.configuration.certificate
• xconnect.search.certificate

Cortex Reporting

App_Config/AppSettings.config

• validateCertificateThumbprint

Marketing Automation

App_Config/AppSettings.config

• validateCertificateThumbprint

App_Config/ConnectionStrings.config

• xconnect.collection.certificate

App_Data/jobs/continuous/AutomationEngine/App_Config/ConnectionStrings.config

• xconnect.collection.certificate

Marketing Automation Reporting

App_Config/AppSettings.config

• validateCertificateThumbprint

Reference Data

App_Config/AppSettings.config

• validateCertificateThumbprint