Steps to repair K2 certificates

 

Overview of K2 Certificates and Configuration Service

K2 uses several certificates critical for its operations. Starting with version 5.3, the introduction of the K2 Configuration Service added the requirement for additional certificates to run correctly. These certificates are typically installed automatically during K2 installation. However, corruption or improper installation can occur, causing issues such as the K2 Configuration Service failing to start with certificate-related errors in the logs.

When such issues arise, the recommended approach is to perform a repair process to regenerate the necessary certificates.

---

Step-by-Step Instructions to Repair K2 Certificates

1. Backup the K2 Database

   • Before any modification, ensure a full backup of the K2 database is taken to prevent data loss.

2. Access the K2 Server

   • Log in to the K2 server using the K2 service account credentials.

3. Open Microsoft Management Console (MMC)

   • Launch mmc.exe.

   • Add the following snap-ins:

     • Certificates (Local Computer)

     • Certificates (Current User)

4. Locate and Delete Target Certificates

   • Navigate to these certificate stores:

     • Personal > Certificates

     • Trusted Root Certification Authorities > Certificates

   • In both locations, delete certificates matching:

     • Issued To: "Environment Owner", Issued By: "K2 On Premise Root"

     • Issued To: "K2 On Premise Root", Issued By: "K2 On Premise Root"

5. Modify the K2 Database Configuration Table

   • Connect to the K2 database and run the following SQL commands to delete certificate-related entries:

5. • sql
     DELETE FROM [HostServer].[Configuration] WHERE VariableToken = '[ROOT_CERT]'
     DELETE FROM [HostServer].[Configuration] WHERE VariableToken = '[ROOT_CERT_THUMBPRINT]'
     DELETE FROM [HostServer].[Configuration] WHERE VariableToken = '[ROOT_CERT_PWD]'
     DELETE FROM [HostServer].[Configuration] WHERE VariableToken = '[CLIENT_AUTH_CERT]'
     DELETE FROM [HostServer].[Configuration] WHERE VariableToken = '[CLIENT_AUTH_CERT_THUMBPRINT]'
     DELETE FROM [HostServer].[Configuration] WHERE VariableToken = '[CLIENT_AUTH_CERT_PWD]'
     DELETE FROM [HostServer].[Configuration] WHERE VariableToken = '[MICRO_SSL_CERT_THUMBPRINT]'
     DELETE FROM [HostServer].[Configuration] WHERE VariableToken = '[MICRO_SSL_CERT]'
     DELETE FROM [HostServer].[Configuration] WHERE VariableToken = '[MICRO_SSL_CERT_PWD]'
     UPDATE [HostServer].[Configuration] SET VariableValue = 'true' WHERE VariableToken = '[SERVICEUSERCHANGED]'
     

   • This clears old or corrupted certificate data to enable fresh regeneration.

6. Run K2 Setup Manager

   • Start the Setup Manager and select the ‘Configure’ option.

   • This will trigger the regeneration and reinstallation of the necessary certificates as part of the service configuration.

---

Additional Notes and Recommendations

• Certificate Validation Utility

  • K2 includes a tool named CertificateManager.exe (found in the K2 installer or the K2Setup folder) which can validate and repair certificates.

  • However, due to known issues with past versions of the CertificateManager utility, including difficulty in tracking compatible versions, it is recommended to avoid using this tool for repairing certificates unless specifically advised by Nintex support.

• Best Practices

  • Always ensure certificates are installed under the Local Computer personal certificate store, as this is the supported scenario.

  • Do not manually delete certificates outside of the documented MMC and database method to avoid orphaned or inconsistent certificate states.

  • Regularly verify services after repair, checking logs for residual certificate errors.

This optimized approach ensures a clean and supported process to repair the K2 Configuration Service certificates and should minimize errors related to corrupted or missing certificates.