Network Management

Creating a new self-signed certificate with 2048 bit key length for internal Orion Platform communications

The article discusses creating a new self-signed certificate with a 2048-bit key length in the Orion Platform.

First published date

9/4/2019 6:09 PM

Last published date

9/2/2025 8:06 PM

Overview

Purpose

The purpose is to create a new Microsoft certificate with a 2048-bit key for your SolarWinds Orion Platform installation to comply with the National Institute of Standards and Technology recommendation that all RSA keys should use 2048-bit keys. This will allow you to use a certificate from a trusted CA for internal Orion Platform communications.

Note:

The information is valid only for upgrades from versions prior to Orion Platform 2016.1. Fresh installations of later versions generate the 2048-bit key automatically.

Warning: Potential Impact on Your Environment

Review the section based on the SolarWinds Platform version you are using:

2023.4 and later

If you are running SolarWinds Platform 2023.4 or later, you must carefully review the following. Failure to act may result in broken connections and impaired monitoring across your environment:

A new certificate will be generated, the keys stay the same.
The new certificate will be automatically populated to all Scalability Engines.
Login to the SolarWinds Platform Web Console is not impaired.

Possible Critical Disruptions:

Container Monitoring: The connection with all Docker, Kubernetes, Docker Swarm, and Apache Mesos containers in the Container Monitoring feature will be broken. See Container Monitoring in the Resolution.
SolarWind Agents: Connection with all SolarWinds Agents will be broken. To solve this, ypu can do one of the following:
- Use a group policy to update agent certificates in bulk. For more information, see Mass Updating Agent Certificate on Servers.
- Partially automate the process using a PowerShell command to reprovision the agent. For more details, see the Orion Agent certificate.
- Reinstall all agents manually.
- Use SWIS verb DeployToNode (deploys one agent at a time).

2023.3 and earlier

If you are running SolarWinds Platform 2023.3 or earlier, you must carefully review the following. Failure to act may result in broken connections and impaired monitoring across your environment:

New certificates and keys are generated.
The new certificate will be automatically populated to all Scalability Engines.
Login to Orion Console is not impaired.

Possible Critical Disruptions:

Environment Monitoring: All saved credentials for monitoring the environment will not be available (the Orion Platform will not be able to decrypt them).
- To solve this issue, you need to re-enter or update the credentials manually.
Orion Agents: Connection with all Orion Agents will be broken. To solve this, do one of the following:
- Use a group policy to update agent certificates in bulk. For more information, see Mass Updating Agent Certificate on Servers.
- Partially automate the process using a PowerShell command to reprovision the agent. For more details, see the Orion Agent certificate.
- Reinstall all agents manually.
- Use SWIS verb DeployToNode (deploys one agent at a time).

Product section

Orion Platform

Resolution

Orion certificate

Please follow these steps based on the SolarWinds Platform version you are running.

2023.4 and later

Create a backup of SolarWinds Platform servers and database.
RDP to the Main Poller.

Open the Database Manager (Default location: C:\Program Files (x86)\SolarWinds\Orion\DatabaseManager.exe) and execute the following query:

-- Scripts are not supported under any SolarWinds support program or service. 
-- Scripts are provided AS IS without warranty of any kind. SolarWinds further 
-- disclaims all warranties including, without limitation, any implied warranties 
-- of merchantability or of fitness for a particular purpose. The risk arising 
-- out of the use or performance of the scripts and documentation stays with you. 
-- In no event shall SolarWinds or anyone else involved in the creation, 
-- production, or delivery of the scripts be liable for any damages whatsoever 
-- (including, without limitation, damages for loss of business profits, business 
-- interruption, loss of business information, or other pecuniary loss) arising 
-- out of the use of or inability to use the scripts or documentation.

UPDATE [dbo].[ServerCertificates] SET Replaced = GETDATE() WHERE Replaced IS NULL

Run the Configuration wizard on the Main Polling Engine, selecting all sections.
During the first run, the Configuration wizard might fail because of the Cortex plugin. In that case, run the Configuration wizard again.
Restart SolarWinds Administration Service on the Main Polling Engine and Scalability Engines.
On the Scalability Engines (additional polling engine, additional web server), run the Configuration wizard with all sections selected.

2023.3 and earlier

WARNING:

Changing the key length will impact credential encryption.

Create a backup of Orion Platform servers and database.
RDP to Main Poller.
Open Microsoft Management Console (Default location: C:\Windows\System32\mmc.exe).
Navigate to File > Add/Remove Snap-in.
In Available snap-ins, select Certificates and click Add.
1. In Certificates snap-in, select Computer account, and click Next.
2. In Select Computer, select Local computer > click Finish.
Click OK.
Navigate the tree in the left section of Microsoft Management Console to Console Root > Certificates (Local Computer) > Personal > Certificates.
Right-click the SolarWinds-Orion certificate and navigate to All Tasks > Export...
1. Click Next.
2. Select Yes, export the private key, and click Next.
3. Select the following:
  - Personal Information Exchange
    - Include all certificates in the certification path if possible
    - Enable certificate privacy
4. Click Next.
5. Select the preferred security and click Next.
6. Specify the location and file name of the exported certificate.
7. Click Next.
8. Click Finish.
In the Microsoft Management Console, right-click the SolarWinds-Orion certificate and select Delete.

Open Database Manager (Default location: C:\Program Files (x86)\SolarWinds\Orion\DatabaseManager.exe) and execute the following query:

-- Scripts are not supported under any SolarWinds support program or service. 
-- Scripts are provided AS IS without warranty of any kind. SolarWinds further 
-- disclaims all warranties including, without limitation, any implied warranties 
-- of merchantability or of fitness for a particular purpose. The risk arising 
-- out of the use or performance of the scripts and documentation stays with you. 
-- In no event shall SolarWinds or anyone else involved in the creation, 
-- production, or delivery of the scripts be liable for any damages whatsoever 
-- (including, without limitation, damages for loss of business profits, business 
-- interruption, loss of business information, or other pecuniary loss) arising 
-- out of the use of or inability to use the scripts or documentation.

DELETE FROM [ServerCertificates]
DELETE FROM [Key]

Delete 'Erlang cookie', 'RabbitMQ user account', and 'Rabbit CA' (in 2023.1 and later) from the Credential and CredentialProperty tables:

-- Scripts are not supported under any SolarWinds support program or service. 
-- Scripts are provided AS IS without warranty of any kind. SolarWinds further 
-- disclaims all warranties including, without limitation, any implied warranties 
-- of merchantability or of fitness for a particular purpose. The risk arising 
-- out of the use or performance of the scripts and documentation stays with you. 
-- In no event shall SolarWinds or anyone else involved in the creation, 
-- production, or delivery of the scripts be liable for any damages whatsoever 
-- (including, without limitation, damages for loss of business profits, business 
-- interruption, loss of business information, or other pecuniary loss) arising 
-- out of the use of or inability to use the scripts or documentation.

DELETE FROM [CredentialProperty] WHERE CredentialID IN (SELECT ID FROM [Credential] WHERE [Name] = 'Erlang cookie' OR [Name] = 'RabbitMQ user account' OR [Name] = 'Rabbit CA') 
DELETE FROM [Credential] WHERE [Name] = 'Erlang cookie' OR [Name] = 'RabbitMQ user account' OR [Name] = 'Rabbit CA'

Remove RabbitMQ certificates and Erlang Cookie from the store located in C:\ProgramData\SolarWinds\Orion\RabbitMQ
1. Delete the *.pem files
2. Delete .erlang.cookie file
Run the Configuration wizard on the Main Polling Engine, selecting all sections.
During the first run, the Configuration wizard might fail because of the Cortex plugin. In that case, run the Configuration wizard again.
Restart SolarWinds Administration Service on the Main Polling Engine and Scalability Engines.
On the Scalability Engines (additional polling engine, additional web server), run the Configuration wizard with all sections selected.

EOC and High Availability

SolarWinds EOC is not affected by the Orion Platform certificate change, as it has its own certificate. It uses SWIS credentials to communicate with other Orion Platform instances.
HA uses the same Orion Platform certificate on the main and standby servers. After you change the Orion Platform certificate, do the following:

Run the Configuration wizard on the standby server to apply the new certificate.
Manually restart SolarWinds Administration Service.

Co

To resolve the broken connection with all Docker, Kubernetes, Docker Swarm, and Apache Mesos containers, complete the following steps:

Go to Settings > Manage Container Services page.
Edit a container.
Go to the second step of wizard.
Run the deployment commands from wizard on dockers/kubernetes/docker swarm/apache mesos machine.
Repeat for all containers.

Orion Agent certificate

The Orion Agent certificate is used in communication with the Main Polling Engine and Additional Polling Engines. It has Orion Certificate set as Certificate Authority, therefore when you change the Orion Platform certificate, connections to all Orion Platform agents will break. Currently, generating a new Agent certificate cannot be done automatically. Instead, there is a workaround using PowerShell and special commands.

NOTE: This is a workaround for advanced users to provide an alternative way to re-provision the agent on a remote machine using PowerShell. It's not a fully supported feature within the Orion Platform.

An example of using a command to automate the menu to reprovision agent on the remote machine:

<#
Scripts are not supported under any SolarWinds support program or service. Scripts are provided AS IS without warranty of any kind. SolarWinds further disclaims all warranties including, without limitation, any implied warranties of merchantability or of fitness for a particular purpose. The risk arising out of the use or performance of the scripts and documentation stays with you. In no event shall SolarWinds or anyone else involved in the creation, production, or delivery of the scripts be liable for any damages whatsoever (including, without limitation, damages for loss of business profits, business interruption, loss of business information, or other pecuniary loss) arising out of the use of or inability to use the scripts or documentation.
#>
 
Write-Output "1`n1`n2`n<IP_Addr>`n4`n<orion_user>`n5`n<orion_passwd>`n7`n`n" | & 'C:\Program Files (x86)\SolarWinds\Agent\SolarWinds.Agent.Service.exe' /reprovision menu=1

The example shows the command to simulate user input - choose agent-initiated communication, enter Poller IP, Orion Username, Orion Password > Save Changes > Exit.

Additional Note:

When SolarWinds.Agent.Service.exe /reprovision menu=1 is executed, a text menu is displayed. Based on parameters represented by numbers, you need to make the desired command. There is a pattern <menu_no>`n<input>`n.

0. Cancel and Exit without Saving
   1. Agent Mode (1 - Agent Initiated, 0 - Server Initiated)  [1]
   2. Orion Poller Hostname/IP  [hostname]
   3. Orion Poller Port         [17778]
   4. Orion Username            [user]
   5. Orion Password            []
   6. Proxy Settings...         [mode=disabled]
   7. Save Changes and Exit

Disclaimer: Please note, any content posted herein is provided as a suggestion or recommendation to you for your internal use. This is not part of the SolarWinds software or documentation that you purchased from SolarWinds, and the information set forth herein may come from third parties. Your organization should internally review and assess to what extent, if any, such custom scripts or recommendations will be incorporated into your environment. You elect to use third-party content at your own risk, and you will be solely responsible for the incorporation of the same if any.