Recipe - App Layering Agent Certificate Update

[Rob Zylowski]

I was doing some upgrades last weekend in my lab and I noticed that even though I upgraded the App Layering Agent on my Provisioning Server to the latest version, there was still a certificate for that agent that was going to expire soon. So, I asked the engineering team about it, and found out that we install a self-signed certificate for the agent to use when it is first installed.  This certificate will expire two years after its created and it will not be automatically updated when new versions of the agent are installed.  So, you need to update it before it expires.

 

You can generate a new one by running the command (as admin):

 

"C:\Program Files (x86)\Citrix\Agent\Citrix.AppLayering.Agent.Service.exe" addcert -port=8016 -force

Note: 8016 is the default port, but if you specified a different one on install then specify that.  The current port can be found in the registry at: HKLM\SYSTEM\CurrentControlSet\Services\Citrix.AppLayering.Agent\Parameters:ListeningPort

 

Here is what my cert looked like before running the command:

 

 

Then after:

 

 

I did not have to delete it, the expiring one was replaced or updated.

[Nick Panaccio]

Just seeing this now. My cert expired on 10/2/20, but everything has worked fine throughout. So... is it even needed?

[Rob Zylowski]

It might depend on what features you use km not sure. Ie don’t know if thats for running scripts

[Nick Panaccio]

Gotcha. I added that step to my App Layering document, so I'll just make sure that the cert is updated at each upgrade now, just in case.

[Rob Zylowski]

Ill try to find out what its used for

[Rob Zylowski]

It is used to encrypt the communication between the ELM and the agent. 

But it might not be validated by the ELM and that's probably why its still working even when expired..