How do I roll back my Service Fabric cluster certificate?

Question

I would like to know how to perform a rollback of a cluster certificate in my Azure Service Fabric Cluster. Can anyone provide some insights?

Sourced from FAQ

Answer 1

[Edited to update the links from internal documentation to external facing]

Rolling back any upgrade to your application requires health failure detection prior to your Service Fabric cluster quorum committing the change; committed changes can only be rolled forward. Escalation engineer’s through Customer Support Services, may be required to recover your cluster, if an unmonitored breaking certificate change has been introduced. Service Fabric’s application upgrade applies Application upgrade parameters, and delivers zero downtime upgrade promise. Following our recommended application upgrade monitored mode, automatic progress through update domains is based upon health checks passing, rolling back automatically if updating a default service fails.

If your cluster is still leveraging the classic Certificate Thumbprint property in your Resource Manager template, it's recommended you Change cluster from certificate thumbprint to common name, to leverage modern secrets management features.

Sourced from FAQ

Answer 2

Performing a rollback of a cluster certificate in your Azure Service Fabric Cluster involves the following steps:

1. Identify the version of the cluster certificate that you want to rollback to.
2. Download the old version of the cluster certificate from the Key Vault or other secure location where it is stored.
3. Upload the old version of the cluster certificate to the Key Vault or other secure location where it is stored, overwriting the current version.
4. Update the Service Fabric Cluster to use the old version of the cluster certificate.

To update the Service Fabric Cluster, you can use the following PowerShell command:

Set-AzServiceFabricClusterCertificate -ResourceGroupName <resource group name> -Name <cluster name> -Thumbprint <thumbprint of old certificate> -CertData <base64 encoded certificate data>

Make sure to replace the placeholders with the appropriate values for your environment.

After running this command, the Service Fabric Cluster should be using the old version of the cluster certificate.