Trouble Accessing Orchestrator Due To Identity Server Certificate's Public Key Size

News Knowledge Base
1

Why is it not possible to browse for the Orchestrator and Identity Server post a change in the certificate recently?

Issue Description: Sometimes, post a certificate change (assuming that the Orchestrator and Identity Server are using the same cert), a 500 error is thrown upon trying to access the Orchestrator as well as Identity Server.


Root Cause:

  • While there are numerous reasons for this to happen, one of the common reasons is when the "Public Key" length of the certificate is less than 2048 bits.
  • Our Identity Server needs the SSL certificate to have a public key on 2048 bits as mentioned here: Orchestrator Certificates
  • In such a case, when checked for the stack trace of the errors in the Event Viewer on the Orchestrator server, find the keywords "Parameter 'key.KeySize'".
  • This can be then confirmed by opening up the certificate via IIS or MMC, and navigating to the "Details" tab as shown below:

Resolution: Request for an updated certificate which has a 2048 bit long public key and follow all other certificate prerequisites as well,