How do I roll back my Service Fabric cluster certificate?

olufemia-MSFT 2,861 Reputation points
2019-10-29T23:43:35.397+00:00

I would like to know how to perform a rollback of a cluster certificate in my Azure Service Fabric Cluster. Can anyone provide some insights?

Sourced from FAQ

Azure Service Fabric
Azure Service Fabric
An Azure service that is used to develop microservices and orchestrate containers on Windows and Linux.
252 questions
0 comments
Accepted answer
  1. Micah McKittrick 946 Reputation points Microsoft Employee
    2019-10-30T16:44:16.117+00:00

    [Edited to update the links from internal documentation to external facing]

    Rolling back any upgrade to your application requires health failure detection prior to your Service Fabric cluster quorum committing the change; committed changes can only be rolled forward. Escalation engineer’s through Customer Support Services, may be required to recover your cluster, if an unmonitored breaking certificate change has been introduced. Service Fabric’s application upgrade applies Application upgrade parameters, and delivers zero downtime upgrade promise. Following our recommended application upgrade monitored mode, automatic progress through update domains is based upon health checks passing, rolling back automatically if updating a default service fails.

    If your cluster is still leveraging the classic Certificate Thumbprint property in your Resource Manager template, it's recommended you Change cluster from certificate thumbprint to common name, to leverage modern secrets management features.

    Sourced from FAQ

    0 comments

1 additional answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. BoboTelar 0 Reputation points
    2023-03-07T02:35:59.85+00:00

    Performing a rollback of a cluster certificate in your Azure Service Fabric Cluster involves the following steps:

    1. Identify the version of the cluster certificate that you want to rollback to.
    2. Download the old version of the cluster certificate from the Key Vault or other secure location where it is stored.
    3. Upload the old version of the cluster certificate to the Key Vault or other secure location where it is stored, overwriting the current version.
    4. Update the Service Fabric Cluster to use the old version of the cluster certificate.

    To update the Service Fabric Cluster, you can use the following PowerShell command:

    Set-AzServiceFabricClusterCertificate -ResourceGroupName <resource group name> -Name <cluster name> -Thumbprint <thumbprint of old certificate> -CertData <base64 encoded certificate data>

    Make sure to replace the placeholders with the appropriate values for your environment.

    After running this command, the Service Fabric Cluster should be using the old version of the cluster certificate.

    0 comments