Direct Access - Expired https-ip certs

[Theldron]

Hi all,

 

Hope you are well.

 

First days back with staff and they said that they haven't been able to access the school drives from home for a few days. I checked and the 5 year certificates have expired. I am struggling to find a way to renew them? Is there any Microsoft documentation for this that I have missed? Or if somebody could point me in the right direction?

 

Many thanks

[chazzy2501]

eeps, hope this doesn't happen to me... maybe go through the wizard on the direct access server again, change nothing and it'll deploy (via GPO) up to date certs?

[chazzy2501]

ok you need to select a new cert in step 2 of the config, but it seems that every solution on the entire internet assumes that I know how to create a new self cert for the job?!? The cert in there was magically created for me! I haven't a sausage how to make a new one or what requirements it has?!

 

murmurs are that a second cert should already be in place a few weeks before expiration deployed then switched over... assuming you have a PKI or know how to do that stuff.

[Theldron]

I know, Direct Access was setup before I started so haven't had to do anything with it.

 

The only thing I have found is this, https://directaccess.richardhicks.com/2019/05/02/renew-directaccess-self-signed-certificates/ not sure if I trust a script to do this though.

 

Microsoft state that you need to renew the cert, but no advice how to actually do it.

[Oaktech]

Hi all,

 

Hope you are well.

 

First days back with staff and they said that they haven't been able to access the school drives from home for a few days. I checked and the 5 year certificates have expired. I am struggling to find a way to renew them? Is there any Microsoft documentation for this that I have missed? Or if somebody could point me in the right direction?

 

Many thanks

 

To avoid absolute chaos the public facing certificate needs to be externally verifiable, so just buy a cert...

 

I sort of followed this guy's instructions, but only as a bit of a crutch.

 

https://directaccess.richardhicks.com/2019/05/02/renew-directaccess-self-signed-certificates/

 

I bought a standard SSL Cert, applied this in the IP-HTTPS bit of the DA config - as he says in the article, if you use a self signed cert every remote device has to come in to have the config applied on site. Then I read the Powershell script in article to work out what PS command was being issued to renew the self signed cert for NLS

 

$NlsCert = (Get-ChildItem -Path Cert:\LocalMachine\My\ | Where-Object Thumbprint -eq ((Get-RemoteAccess).NlsCertificate | Select-Object -ExpandProperty Thumbprint))  

 

and then

 

$NewCert = New-SelfSignedCertificate -CloneCert $NlsCert -CertStoreLocation 'Cert:\LocalMachine\My'

 

and then applied it via the config wizard, because I like a GUI.