How To: Change the License Info Certificate

Version Affected: All

 

Overview

The License Info certificate, found on the System Info tab, is used to encrypt several sensitive values:

• Values stored in Active Directory, such as the KBQ/KBA answers and the OATH seed (and any other attribute manually configured to be encrypted).
• Values stored in the realm's web.config, such as the Datastore password, the Forms-Based Authentication (FBA) password, and the API ID and Key.

Changing the License Info certificate is not recommended, even after it has expired — every value above was encrypted with the old certificate, and none of it is automatically re-encrypted when the certificate changes. Follow this procedure only if you have no other option, and do not proceed at all if the realm still relies on OATH seed or other AD-encrypted attributes such as KBQ/KBA, since those values cannot be recovered once the certificate that encrypted them is gone.

Changing the License Info certificate

1. Before changing anything, record the Datastore password(s) for the realm.
2. If the realm uses an FBA service account (on the Workflow tab), record that password too.
3. Go to the API tab and copy the current API ID and Key somewhere safe.
4. Take a full backup of the realm's web.config so you can revert if needed.
5. Change the License Info certificate on the System Info tab.
6. Re-encrypt the API ID with the new certificate:
   1. Go to the Workflow tab and scroll to the FBA WebService section.
   2. Enter the API App ID into the FBA WebService Password field and save. SecureAuth encrypts this field using the current (new) License Info certificate.
   3. Decrypt the web.config.
   4. Find fbaservicepass in the decrypted web.config and copy its value — this is the API App ID, now encrypted with the new certificate.
   5. Paste that value into the real Api.AppId field in the web.config.
   6. Save the web.config.
7. Repeat the same technique from step 6 for the API Key, using Api.AppKey as the destination field instead of Api.AppId.
8. Go to the Data tab and re-enter the Datastore service account password you recorded in step 1, so it gets encrypted with the new certificate.
9. If this is a Web Service realm, go to the Workflow tab and re-enter the FBA service account password you recorded in step 2.

Special Considerations:

Changing the License Info certificate is not recommended. This procedure is a guide only — depending on the realm's configuration, additional encrypted values may need to be re-entered that aren't listed above.


 

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.