Windows Orchestrator Uses the Old Outdated Certificate Even After a Fresh Certificate Update

News Knowledge Base
1

Why do I see the old Orchestrator certificate in the browser even after a certificate update?

Issue description

Sometimes after a certificate update for a Windows Orchestrator, one might run into an issue wherein the new certificate changes do not reflect within the browser. As such, you might see something similar to the following:

kb-0EM5b00000EGBpP.png933×637 73.6 KB

Resolution

  1. Start by verifying if the Orchestrator site bindings within IIS point to the newly deployed certificate. In general, ensure that you have followed all these steps diligently to update the Orchestrator certificate: Changing The SSL Certificate For UiPath Orchestrator Website.
  2. Orchestrator essentially authenticates via the Identity Server which requires a token signing certificate (same/different than the Orchestrator certificate). If you are using the Orchestrator certificate for the Identity Server as well, make sure that the appsettings for the Identity Server have been updated (How to change the Identity Server Signing Certificate?).
  3. If on a multi-node setup, verify that the certificate changes have been carried out on all the Orchestrator nodes as well as the Load Balancer.
  4. If you have a firewall, you might need to install the new Orchestrator certificate there too.
  5. If the old expired/outdated Orchestrator certificate is still present on the server ('Personal' and 'Trusted Root' folders within the Certificate Manager on the Local Machine), consider deleting the same. If applicable, delete and reinstall the new certificate with a different friendly name than what was used for the previous certificate(s).
  6. Clear the cache in the browser or consider using an alternate/private browser and check if that helps alleviate the issue.
  7. Reboot the Orchestrator server(s) as well as the Load Balancer.
  8. If the issue is still persisting, you might consider reviewing the following:
    • Check if the affected users are behind a proxy that caches certificates. For example, if they're behind a Smoothwall proxy that generates its own certificates after inspecting HTTPS traffic and caches them.
    • Verify If the domain provider is supplying a certificate or caching one at that level.
    • If you have any intermediate certificate(s) please install/reinstall them.
    • In rare scenarios, this issue has been attributed to network issues pertaining to the IIS content server(s). As such, we find that rebooting all key servers, including the load balancer and content servers, effectively clears the server's cache of the old certificate, resolving the issue of an IIS application still showing an old certificate. Additionally, it's vital to ensure that each content server within the IIS setup has a unique static IP address. At times, if a content server possesses a static IP address that is in use elsewhere on the network, the ARR (Application Request Routing) server defaults to using another content server. This could lead to intermittent site delivery issues, such as occasional 502 errors, which could be mistakenly attributed to a new SSL certificate installation. Therefore, addressing potential IP address conflicts and rebooting all associated servers usually helps to resolve such issues. Consider reviewing this with the Network team to see if it applies.