SHA1 - how to get a SHA2 cert. update?

Question

_{Thursday, February 9, 2017 1:26 AM}

i have Windows Server Essentials 2012 R2. I noticed the remote web access prompted me about the SHA1 certificate.

I am using the free domain remotewebaccess.com.

How do I go about getting this certificate updated to SHA2? Is there a guide anywhere, I have no experience managing certificates etc.

Tim

All replies (9)

_{Tuesday, February 21, 2017 8:16 PM ✅Answered}

I gave this some thought and came up with this simple solution. If you just rerun the Setup wizard for Anywhere Access you will get a new SHA2 certificate. If you want to keep your old domain (*.remotewebaccess.com) make sure you do NOT select the release option. This way your original domain will still be yours and you can select that when you run the wizard a second time after deleting your old SHA1 certificate.

_{Thursday, February 9, 2017 6:44 AM}

Hi Higgsy1,

I assume you administer the remote access website. If you don't, there's nothing you can do but notify the administrators.

If you do, you have to replace the certificate. There's no way to upgrade a certificate, you have to get a new one. The precise details how to depend on the application used to host the website, and the way the certificate was signed (self-signed or CA signed, and in the latter case which CA). So first you need to find out those things and then look up the articles that tell you how to operate your tooling.

Kind Regards,

_{Friday, February 10, 2017 8:04 AM}

Hi,

I am checking to see how things are going there on this issue.

Please let me know if you would like further assistance.

Best Regards,
Eve Wang

Please remember to mark the replies as answers if they help.
If you have feedback for TechNet Subscriber Support, contact [email protected].

_{Tuesday, February 21, 2017 6:04 AM}

I don't administer the remotewebaccess.com domain.

I got it via Microsoft as part of the wizard setup when I installed "Windows Server Essentials 2012 R2"

Surely someone else must have this issue?

Tim

_{Tuesday, February 21, 2017 7:42 AM}

Thanks for the clarification.

First, you'd have to determine where the certificate is coming from. If you open the Certificates - Local Computer MMC snap-in, you should be able to find it in Personal -> Certificates. Double click it. Verify that the "Issued To" is remotewebaccess.com, and note the "Issued By" statement. You'll either find that this too is remotewebaccess.com (indicating it's a self-signed certificate), or some CA.

Either way, you'll have to replace the certificate. You may want to replace the self-signed certificate by a CA-signed one, these days you can get free SSL certificates at https://letsencrypt.org/. If it's CA signed, it makes the most sense to have the replacement one also issued by the same CA, which I assume would be upgraded by now to issue SHA256 certificates.

I hope this helps you on your way.

Kind Regards,

_{Tuesday, February 21, 2017 6:06 PM}

I have occasionally been trying to find a solution to this for over a year. I too am very surprised that there is so little information to find on the issue. I believe that all of the certificates for *.remotewebaccess.com domains is issued by GoDaddy somehow via Microsoft since I guess none of us has payed anything for it. I would be very pleased if someone could shed some light on this.

Best regards

_{Tuesday, February 21, 2017 10:23 PM}

Thanks JanBaanan that has solved my issue.

Tim

_{Wednesday, April 26, 2017 12:42 PM}

Hi,

How does this work in practice?

When I click 'Next' after having chosen 'Use another domain name or domain name service provider' can I then enter the same domain name again as the existing one?

Or should I enter a different domain name (if I do that, my client PCs joined to the existing domain would be messed up?) and subsequently run the wizard another time to revert to the original domain name?

Kind regards,

Antoon.

_{Wednesday, April 26, 2017 5:27 PM}

Hi,

How does this work in practice?

When I click 'Next' after having chosen 'Use another domain name or domain name service provider' can I then enter the same domain name again as the existing one?

Or should I enter a different domain name (if I do that, my client PCs joined to the existing domain would be messed up?) and subsequently run the wizard another time to revert to the original domain name?

Kind regards,

Antoon.

OK, I can reply to my own question. You run the wizard as described by JanBaanan and when prompted to enter the 'new' domain name, you fill out exactly the same one as you already have on that server. The new window then asks for your Microsoft account and that's it! After completing the wizard, you'll see that your encryption was changed to sha256 .