Renew certificates in System Center 2012 R2 Virtual Machine Manager

This article contains information about how to renew certificates in Microsoft System Center 2012 R2 Virtual Machine Manager (VMM) by using the certificates renewal utility.

This utility enables you to renew the following:

• Expired certificates
• Certificates that are about to expire. In this case, you can proactively avoid the downtime of the VMM server that can occur when certificates expire.

Before you install the utility

1. Install Update Rollup 14 for System Center 2012 R2 Virtual Machine Manager on the standalone VMM server or the Highly Available VMM cluster.
2. Download the utiltiy from the Microsoft Download Center.
3. Extract the "SCVMM_2012_R2_RENEW_CERT.EXE" file to a temporary location. The following files are extracted.
    

   Filename	File version	File size
   Vmmcertutil.exe	3.2.8457.0	68,432
   Software Update Supplemental Notice for System Center 2012 R2 Virtual Machine Manager.rtf	Not applicable	86,581

Install the utility on a standalone VMM server

1. Run the Vmmcertutil.exe file. Read and accept the license agreement.
   
   
2. Enter the location into which you want to put the extracted files. For example, enter the \bin folder path of the VMM installation. By default, the VMM installation is located in the following folder:
   C:\Program Files\Microsoft System Center 2012 R2\Virtual Machine Manager\bin
   
   
3. After the files are extracted, open an elevated Command Prompt window. Type the following command, and then press Enter:
   "%VMMINSTALLPATH%\bin\vmmcertutil.exe" console Renewvmmnodecertificate
   
   Note In this command, replace the <%VMMINSTALLPATH%> placeholder by using the VMM installation folder path.
4. If you have any existing PXE servers in your VMM environment, update the PXE image. To do this in the VMM console, right-click the PXE server, and then click Update WinPE Image.

After you update the certificates, you can delete the Vmmcertutil.exe file from the \bin folder.

Install the update on Highly Available (HA) VMM cluster nodes

1. Copy the Vmmcertutil.exe file to the VMM bin folder (%VMMINSTALLPATH%\bin) on all the HAVMM cluster nodes.
   
   Note: The <%VMMINSTALLPATH%> placeholder represents the installation folder for System Center 2012 R2 Virtual Machine Manager. For example, the installation folder is as follows: 
   
   C:\Program Files\Microsoft System Center 2012 R2\Virtual Machine Manager
2. Go to the HAVMM active node, log on to the node by using the VMM service account (the account under which VMM is running). You can also use any other account that has the required permissions on the HAVMM cluster and VMM SQL server.
3. On the active node, open an elevated Command Prompt window. Type the following commands, and press Enter after each command:

   "%VMMINSTALLPATH%\bin\vmmcertutil.exe" console Renewvmmnodecertificate

   "%VMMINSTALLPATH%\bin\vmmcertutil.exe" console RenewHavmmRoleCertificate

4. Go to the passive nodes, and log on to the node by using the VMM service account (the account under which VMM is running). You can also use any other account that has the required permissions on the HAVMM cluster and VMM SQL Server. At an elevated command prompt, type the following commands, and press Enter after each command:

   "%VMMINSTALLPATH%\bin\vmmcertutil.exe" console RenewVmmNodeCertificate

   “%VMMINSTALLPATH% \bin\vmmcertutil.exe" console UpdateHavmmRoleCertificate

5. After all the passive nodes are updated, perform failover to any passive node.
6. If there are any existing PXE servers in VMM, update the Windows PE image. To update the Windows PE image from the VMM console, right-click the PXE server, and then click Update WinPE Image.

After you update the certificates, you can delete the Vmmcertutil.exe file from all HAVMM cluster nodes.