Updating Certificates

[stuart7777]

Hi,
We use a certificate to authenticate to the EntraCP app registration. This successfully works. However, I need to document, and test, the process of updating the certificate. In the GUI I can see the added tenant and if I click edit it just allows me to input another client secret. Can you please advise me on what is the best way to update the certificate without any downtime?
Thanks,
Stuart

[Yvand]

@stuart7777 this is documented here. This won't cause any downtime because you can have both certs at same time in Entra, and EntraCP will use the new one as soon as its config is committed in the config db

[stuart7777]

Hi,
I tried running the PowerShell script to update the certificate used to authenticate against the app registration. However, when I do this the configuration changes to use a Client Secret with a Client ID as the PFX password. Also when I use the GUI to initially add the tenant I have to use the tenant ID not the tenant name, so I have followed the same in the PowerShell script.
The below is script that I ran:

Add-Type -AssemblyName "Yvand.EntraCP, Version=1.0.0.0, Culture=neutral, PublicKeyToken=65dc6b5903b51636"
$config = [Yvand.EntraClaimsProvider.EntraCP]::GetConfiguration()
$newCertificatePath = "C:\Users\Stuart.APPLEYBRIDGE\Downloads\EntraCP2.pfx"
$newCertificatePassword = "Password"
$config.UpdateTenantCredentials("f78e8a9e-4fbd-4826-a514-90b2883db495", $newCertificatePath, $newCertificatePassword)
$config.Update($true)

I've attached the before (working with client certificate) and after with a messed up configuration.
Working with client certificate

After updating - messed up

Can you please help?

Stuart

[stuart7777]

I have now changed the below line to use Client ID rather than the Tenant ID. The results is it looks like the before picture now, however, the Picker doesn't resolve any names, so it still isn't updating correctly.
$config.UpdateTenantCredentials("f78e8a9e-4fbd-4826-a514-90b2883db495", $newCertificatePath, $newCertificatePassword)

The GUID is my app's Client ID

Also, I get a result of false displayed after running the script.

If I upload the old .cer (the new .cer is already uploaded) to the app registration it all starts working again, so the new certificate mustn't be getting updated in the DB.

I also tried this too and still got the false result
Add-Type -AssemblyName "Yvand.EntraCP, Version=1.0.0.0, Culture=neutral, PublicKeyToken=65dc6b5903b51636"
$config = [Yvand.EntraClaimsProvider.EntraCP]::GetConfiguration()

Update tenant credentials with new certificate

$config.UpdateTenantCredentials(
"M365x68047854.onmicrosoft.com",
"19b23d68-3ac0-4c9a-a25b-755f4fe550a5",
"C:\Users\Stuart.APPLEYBRIDGE\Downloads\EntraCP2.pfx",
"Password"
)

[stuart7777]

It looks like the order of the arguments need to be in the order tenant, path to PFX, PFX password, ClientID.
I used the below script and got a true result, but if I then delete the old .cer from Entra the picker stops working. So it still isn't working and is important for us to have a documented and tested process prior to deploying in production.

Can you please help?

Add-Type -AssemblyName "Yvand.EntraCP, Version=1.0.0.0, Culture=neutral, PublicKeyToken=65dc6b5903b51636"
$config = [Yvand.EntraClaimsProvider.EntraCP]::GetConfiguration()

Update tenant credentials with new certificate

$config.UpdateTenantCredentials(
"M365x68047854.onmicrosoft.com",
"C:\Users\Stuart.APPLEYBRIDGE\Downloads\EntraCP2.pfx",
"Password",
"19b23d68-3ac0-4c9a-a25b-755f4fe550a5"

[stuart7777]

Please see the comments I've added above as I'm still unable to update the client certificate and we need this to allow the EntraCP to be deployed into production.

[Yvand]

Understood, I will test this again and come back to you next week

[stuart7777]

Thank you Yvan. I look forward to hearing from you. Stuart Townsend Solution Architect Group Professional Services ***@***.*** Digital World Centre, 1 Lowry Plaza, Salford Quays Manchester, M50 3UB, United Kingdom Computacenter (UK) Ltd T: +44 (0) 161 848 2511 M: +44 (0) 7834 650368 E: ***@***.******@***.***> www.computacenter.com<https://www.computacenter.com/uk> | X<https://twitter.com/ComputacenterUK> | LinkedIn<http://www.linkedin.com/company/computacenter> | YouTube<http://www.youtube.com/computacenteruk> From: Yvan Duhamel ***@***.***> Sent: 21 November 2025 16:21 To: Yvand/EntraCP ***@***.***> Cc: Townsend, Stuart ***@***.***>; State change ***@***.***> Subject: Re: [Yvand/EntraCP] Updating Certificates (Discussion #332) EXTERNAL EMAIL - EXERCISE CARE WITH LINKS AND ATTACHMENTS Understood, I will test this again and come back to you next week - Reply to this email directly, view it on GitHub<#332 (reply in thread)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/AJRFYFNKXGAZWCIOS6QE42L3543WZAVCNFSM6AAAAACMLRMI7CVHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTKMBTHE4TQNA>. You are receiving this because you modified the open/close state.Message ID: ***@***.******@***.***>> ********************************************************************** COMPUTACENTER PLC is registered in England and Wales with the registered number 03110569. Its registered office is at Hatfield Business Park, Hatfield Avenue, Hatfield, Hertfordshire AL10 9TW COMPUTACENTER (UK) Limited is registered in England and Wales with the registered number 01584718. Its registered office is at Hatfield Business Park, Hatfield Avenue, Hatfield, Hertfordshire AL10 9TW COMPUTACENTER (Mid-Market) Limited is registered in England and Wales with the registered number 3434654. Its registered office is at Hatfield Business Park, Hatfield Avenue, Hatfield, Hertfordshire AL10 9TW COMPUTACENTER (FMS) Limited is registered in England and Wales with the registered number 3798091. Its registered office is at Hatfield Business Park, Hatfield Avenue, Hatfield, Hertfordshire AL10 9TW The contents of this email are intended for the named addressee only. It contains information which may be confidential and which may also be privileged. Unless you are the named addressee (or authorised to receive mail for the addressee) you may not copy or use it, or disclose it to anyone else. If you receive it in error please notify us immediately and then destroy it. Computacenter information is available from: http://www.computacenter.com<http://www.computacenter.com/> Privacy Notice<https://www.computacenter.com/en/privacy-notice-art-13-14/> **********************************************************************

[Yvand]

You are correct, there was something wrong with the script, which is because both methods UpdateTenantCredentials have an optional newClientId parameter.
In short tern, to avoid any issue, the 4th parameter must be set explicitly (I just updated the doc).
To fix your scenario, you must the client ID in the 4th parameter:

Add-Type -AssemblyName "Yvand.EntraCP, Version=1.0.0.0, Culture=neutral, PublicKeyToken=65dc6b5903b51636"
$config = [Yvand.EntraClaimsProvider.EntraCP]::GetConfiguration()
$newCertificatePath = "C:\YvanData\config\certs\azurecp.aadcert.pfx"
$newCertificatePassword = "certicicatePassword"
$config.UpdateTenantCredentials("TENANTNAME.onmicrosoft.com", $newCertificatePath, $newCertificatePassword, "YOURCLIENTID")
$config.Update($true)

In next version, I'll rename methods UpdateTenantCredentials: #334

[stuart7777]

Hi Yvan, I did try that and it gave a result of true, but if I deleted the old .cer from the app registration the People Picker failed to work after a server reboot to restart all services, so I assume the old certificate in the SharePoint DB must still being used. I hope you are able to fix this. Kind regards, Stuart Townsend Solution Architect Group Professional Services ***@***.*** Digital World Centre, 1 Lowry Plaza, Salford Quays Manchester, M50 3UB, United Kingdom Computacenter (UK) Ltd T: +44 (0) 161 848 2511 M: +44 (0) 7834 650368 E: ***@***.******@***.***> www.computacenter.com<https://www.computacenter.com/uk> | X<https://twitter.com/ComputacenterUK> | LinkedIn<http://www.linkedin.com/company/computacenter> | YouTube<http://www.youtube.com/computacenteruk> From: Yvan Duhamel ***@***.***> Sent: 24 November 2025 09:50 To: Yvand/EntraCP ***@***.***> Cc: Townsend, Stuart ***@***.***>; State change ***@***.***> Subject: Re: [Yvand/EntraCP] Updating Certificates (Discussion #332) EXTERNAL EMAIL - EXERCISE CARE WITH LINKS AND ATTACHMENTS You are correct, there was something wrong with the script, which is because both methods UpdateTenantCredentials have an optional newClientId parameter. In short tern, to avoid any issue, the 4th parameter must be set explicitly (I just updated the doc<https://entracp.yvand.net/docs/how-to/set-the-credentials/>). To fix your scenario, you must the client ID in the 4th parameter: Add-Type -AssemblyName "Yvand.EntraCP, Version=1.0.0.0, Culture=neutral, PublicKeyToken=65dc6b5903b51636" $config = [Yvand.EntraClaimsProvider.EntraCP]::GetConfiguration() $newCertificatePath = "C:\YvanData\config\certs\azurecp.aadcert.pfx" $newCertificatePassword = "certicicatePassword" $config.UpdateTenantCredentials("TENANTNAME.onmicrosoft.com", $newCertificatePath, $newCertificatePassword, "YOURCLIENTID") $config.Update($true) In next version, I'll rename methods UpdateTenantCredentials: #334<#334> - Reply to this email directly, view it on GitHub<#332 (reply in thread)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/AJRFYFNNVQWG4MRIX252L5D36LIDVAVCNFSM6AAAAACMLRMI7CVHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTKMBVHE4TIOA>. You are receiving this because you modified the open/close state.Message ID: ***@***.******@***.***>> ********************************************************************** COMPUTACENTER PLC is registered in England and Wales with the registered number 03110569. Its registered office is at Hatfield Business Park, Hatfield Avenue, Hatfield, Hertfordshire AL10 9TW COMPUTACENTER (UK) Limited is registered in England and Wales with the registered number 01584718. Its registered office is at Hatfield Business Park, Hatfield Avenue, Hatfield, Hertfordshire AL10 9TW COMPUTACENTER (Mid-Market) Limited is registered in England and Wales with the registered number 3434654. Its registered office is at Hatfield Business Park, Hatfield Avenue, Hatfield, Hertfordshire AL10 9TW COMPUTACENTER (FMS) Limited is registered in England and Wales with the registered number 3798091. Its registered office is at Hatfield Business Park, Hatfield Avenue, Hatfield, Hertfordshire AL10 9TW The contents of this email are intended for the named addressee only. It contains information which may be confidential and which may also be privileged. Unless you are the named addressee (or authorised to receive mail for the addressee) you may not copy or use it, or disclose it to anyone else. If you receive it in error please notify us immediately and then destroy it. Computacenter information is available from: http://www.computacenter.com<http://www.computacenter.com/> Privacy Notice<https://www.computacenter.com/en/privacy-notice-art-13-14/> **********************************************************************

[Yvand]

Hi @stuart7777, I did test the script in #332 (reply in thread) and it really works. But as I mentioned, you must pass the actual clientId value in last parameter (not an empty string). Did you try that?

[stuart7777]

Hi Yvan, Yes I did. If you look back at the tread for 5 days ago I posted the below and it didn't work for me. Is that all I need to run? $config.UpdateTenantCredentials( "M365x68047854.onmicrosoft.com", "C:\Users\Stuart.APPLEYBRIDGE\Downloads\EntraCP2.pfx", "Password", "19b23d68-3ac0-4c9a-a25b-755f4fe550a5" Stuart Townsend Solution Architect Group Professional Services ***@***.*** Digital World Centre, 1 Lowry Plaza, Salford Quays Manchester, M50 3UB, United Kingdom Computacenter (UK) Ltd T: +44 (0) 161 848 2511 M: +44 (0) 7834 650368 E: ***@***.******@***.***> www.computacenter.com<https://www.computacenter.com/uk> | X<https://twitter.com/ComputacenterUK> | LinkedIn<http://www.linkedin.com/company/computacenter> | YouTube<http://www.youtube.com/computacenteruk> From: Yvan Duhamel ***@***.***> Sent: 24 November 2025 10:02 To: Yvand/EntraCP ***@***.***> Cc: Townsend, Stuart ***@***.***>; Mention ***@***.***> Subject: Re: [Yvand/EntraCP] Updating Certificates (Discussion #332) EXTERNAL EMAIL - EXERCISE CARE WITH LINKS AND ATTACHMENTS Hi @stuart7777<https://github.com/stuart7777>, I did test the script in #332 (reply in thread)<#332 (reply in thread)> and it really works. But as I mentioned, you must pass the actual clientId value in last parameter (not an empty string). Did you try that? - Reply to this email directly, view it on GitHub<#332 (reply in thread)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/AJRFYFMSUU46EEMAYVLHNXL36LJRJAVCNFSM6AAAAACMLRMI7CVHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTKMBWGAYDSNY>. You are receiving this because you were mentioned.Message ID: ***@***.******@***.***>> ********************************************************************** COMPUTACENTER PLC is registered in England and Wales with the registered number 03110569. Its registered office is at Hatfield Business Park, Hatfield Avenue, Hatfield, Hertfordshire AL10 9TW COMPUTACENTER (UK) Limited is registered in England and Wales with the registered number 01584718. Its registered office is at Hatfield Business Park, Hatfield Avenue, Hatfield, Hertfordshire AL10 9TW COMPUTACENTER (Mid-Market) Limited is registered in England and Wales with the registered number 3434654. Its registered office is at Hatfield Business Park, Hatfield Avenue, Hatfield, Hertfordshire AL10 9TW COMPUTACENTER (FMS) Limited is registered in England and Wales with the registered number 3798091. Its registered office is at Hatfield Business Park, Hatfield Avenue, Hatfield, Hertfordshire AL10 9TW The contents of this email are intended for the named addressee only. It contains information which may be confidential and which may also be privileged. Unless you are the named addressee (or authorised to receive mail for the addressee) you may not copy or use it, or disclose it to anyone else. If you receive it in error please notify us immediately and then destroy it. Computacenter information is available from: http://www.computacenter.com<http://www.computacenter.com/> Privacy Notice<https://www.computacenter.com/en/privacy-notice-art-13-14/> **********************************************************************

[Yvand]

Did you run $config.Update($true) to commit the changes?

[stuart7777]

I thought I did but I'll test it again and let you know. This maybe tomorrow as I'm maxed out today. Thanks for you help. Stuart Townsend Solution Architect Group Professional Services ***@***.*** Digital World Centre, 1 Lowry Plaza, Salford Quays Manchester, M50 3UB, United Kingdom Computacenter (UK) Ltd T: +44 (0) 161 848 2511 M: +44 (0) 7834 650368 E: ***@***.******@***.***> www.computacenter.com<https://www.computacenter.com/uk> | X<https://twitter.com/ComputacenterUK> | LinkedIn<http://www.linkedin.com/company/computacenter> | YouTube<http://www.youtube.com/computacenteruk> From: Yvan Duhamel ***@***.***> Sent: 24 November 2025 10:16 To: Yvand/EntraCP ***@***.***> Cc: Townsend, Stuart ***@***.***>; Mention ***@***.***> Subject: Re: [Yvand/EntraCP] Updating Certificates (Discussion #332) EXTERNAL EMAIL - EXERCISE CARE WITH LINKS AND ATTACHMENTS Did you run $config.Update($true) to commit the changes? - Reply to this email directly, view it on GitHub<#332 (reply in thread)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/AJRFYFIP42AVHHHP6DWDR6D36LLENAVCNFSM6AAAAACMLRMI7CVHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTKMBWGAZDOMA>. You are receiving this because you were mentioned.Message ID: ***@***.******@***.***>> ********************************************************************** COMPUTACENTER PLC is registered in England and Wales with the registered number 03110569. Its registered office is at Hatfield Business Park, Hatfield Avenue, Hatfield, Hertfordshire AL10 9TW COMPUTACENTER (UK) Limited is registered in England and Wales with the registered number 01584718. Its registered office is at Hatfield Business Park, Hatfield Avenue, Hatfield, Hertfordshire AL10 9TW COMPUTACENTER (Mid-Market) Limited is registered in England and Wales with the registered number 3434654. Its registered office is at Hatfield Business Park, Hatfield Avenue, Hatfield, Hertfordshire AL10 9TW COMPUTACENTER (FMS) Limited is registered in England and Wales with the registered number 3798091. Its registered office is at Hatfield Business Park, Hatfield Avenue, Hatfield, Hertfordshire AL10 9TW The contents of this email are intended for the named addressee only. It contains information which may be confidential and which may also be privileged. Unless you are the named addressee (or authorised to receive mail for the addressee) you may not copy or use it, or disclose it to anyone else. If you receive it in error please notify us immediately and then destroy it. Computacenter information is available from: http://www.computacenter.com<http://www.computacenter.com/> Privacy Notice<https://www.computacenter.com/en/privacy-notice-art-13-14/> **********************************************************************

[stuart7777]

Hi Yvan, I decided to test it this morning as I just wanted to make sure it worked. I think I'd tested so many things and eventually got the syntax correct with Client ID at the end and tenant at the front, but I must have missed running $config.Update($true) Are you going to update the Set a new client certificate in Set the credentials | EntraCP<https://entracp.yvand.net/docs/how-to/set-the-credentials/> as there is no mention of Client ID in the command line? I refer to that section in my documents. Thanks for your help. Stuart Townsend Solution Architect Group Professional Services ***@***.*** Digital World Centre, 1 Lowry Plaza, Salford Quays Manchester, M50 3UB, United Kingdom Computacenter (UK) Ltd T: +44 (0) 161 848 2511 M: +44 (0) 7834 650368 E: ***@***.******@***.***> www.computacenter.com<https://www.computacenter.com/uk> | X<https://twitter.com/ComputacenterUK> | LinkedIn<http://www.linkedin.com/company/computacenter> | YouTube<http://www.youtube.com/computacenteruk> From: Yvan Duhamel ***@***.***> Sent: 24 November 2025 10:16 To: Yvand/EntraCP ***@***.***> Cc: Townsend, Stuart ***@***.***>; Mention ***@***.***> Subject: Re: [Yvand/EntraCP] Updating Certificates (Discussion #332) EXTERNAL EMAIL - EXERCISE CARE WITH LINKS AND ATTACHMENTS Did you run $config.Update($true) to commit the changes? - Reply to this email directly, view it on GitHub<#332 (reply in thread)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/AJRFYFIP42AVHHHP6DWDR6D36LLENAVCNFSM6AAAAACMLRMI7CVHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTKMBWGAZDOMA>. You are receiving this because you were mentioned.Message ID: ***@***.******@***.***>> ********************************************************************** COMPUTACENTER PLC is registered in England and Wales with the registered number 03110569. Its registered office is at Hatfield Business Park, Hatfield Avenue, Hatfield, Hertfordshire AL10 9TW COMPUTACENTER (UK) Limited is registered in England and Wales with the registered number 01584718. Its registered office is at Hatfield Business Park, Hatfield Avenue, Hatfield, Hertfordshire AL10 9TW COMPUTACENTER (Mid-Market) Limited is registered in England and Wales with the registered number 3434654. Its registered office is at Hatfield Business Park, Hatfield Avenue, Hatfield, Hertfordshire AL10 9TW COMPUTACENTER (FMS) Limited is registered in England and Wales with the registered number 3798091. Its registered office is at Hatfield Business Park, Hatfield Avenue, Hatfield, Hertfordshire AL10 9TW The contents of this email are intended for the named addressee only. It contains information which may be confidential and which may also be privileged. Unless you are the named addressee (or authorised to receive mail for the addressee) you may not copy or use it, or disclose it to anyone else. If you receive it in error please notify us immediately and then destroy it. Computacenter information is available from: http://www.computacenter.com<http://www.computacenter.com/> Privacy Notice<https://www.computacenter.com/en/privacy-notice-art-13-14/> **********************************************************************

[Yvand]

Yes I will review this for the next version, see #335