ServiceFabric standalone Windows cluster, x509 certificate

Question

ServiceFabric standalone Windows cluster, x509 certificate

Gennart, Tony 46

Hello,

I have a serviceFabric cluster on-premise using security ClusterConfig.X509.MultiMachine via internal certificate PKI. Current issuer on PKI will expire and i must change my config to refer the new issuer.

The question is: In this section "ClusterCertificateIssuerStores" only 2 issuer are allowed. For now i have my intermediate issuer and root issuer. Is it mandatory to have intermediate + root issuer? Is it enough to only reference Root issuer without intermediate or the complete path of issuer must me present in configuration?

e.g:

User's image

In fact, I have to replace intemediate CA 1 by the new but if root is enough probably nothing to do...

related doc: https://learn.microsoft.com/en-us/azure/service-fabric/service-fabric-windows-cluster-x509-security

Thanks in advance.

Tony

Durga Reshma Malthi 9,840 Reputation points Microsoft External Staff Moderator

2025-05-16T09:07:58.7833333+00:00

Hi Gennart, Tony

Just checking in to see if you had a chance to review the response provided to your question.

Feel free to reach out if you have any further queries.

If you found the information helpful, please click "Upvote" on the post to let us know.

Accepted answer

0 additional answers

Your answer

Durga Reshma Malthi 9,840 Reputation points Microsoft External Staff Moderator

2025-05-16T09:07:58.7833333+00:00

Hi Gennart, Tony

Just checking in to see if you had a chance to review the response provided to your question.

Feel free to reach out if you have any further queries.

If you found the information helpful, please click "Upvote" on the post to let us know.

Answer 1

Durga Reshma Malthi 9,840 Microsoft External Staff Moderator

Hi Gennart, Tony

Yes, you can specify both the intermediate and the root CA. If your cluster explicitly requires the intermediate issuer, you must update it when replacing the old intermediate CA. If your cluster can validate certificates using only the root issuer, then no changes may be needed.

In your case, since you're replacing the intermediate CA, you need to replace the old intermediate CA with the new intermediate CA and keep the root CA if it remains unchanged.

"ClusterCertificateIssuerStores": [
  {
    "IssuerCommonName": "Issuer Root CA",
    "X509StoreNames": "Root CA"
  },
  {
    "IssuerCommonName": "Issuer Int CA 2",  // new intermediate CA
    "X509StoreNames": "Issuing CA 2"
  }
]

After updating, please restart the Service Fabric cluster and validate that all services are working correctly with the new certificate paths.

Hope this helps!

Please Let me know if you have any queries.

Durga Reshma Malthi 9,840 Reputation points Microsoft External Staff Moderator

2025-05-19T08:46:39.59+00:00

Hi Gennart, Tony

Just checking in to see if you had a chance to review the response provided to your question.

Feel free to reach out if you have any further queries.

If you found the information helpful, please click "Upvote" on the post to let us know and consider accepting the answer as a token of appreciation. Thank You.

Share via

ServiceFabric standalone Windows cluster, x509 certificate

0 additional answers

Your answer