重設 SharePoint 工作流程管理員的憑證產生金鑰

發行項
04/18/2023

SharePoint 工作流程管理員 (SPWFM) 憑證產生金鑰類似于 SharePoint 伺服器陣列複雜密碼，因為您需要它來加入 SPWFM 伺服器陣列。加入現有的 SPWFM 伺服器陣列時，例如在升級或移轉期間，工作流程設定精靈會提示您提供該伺服器陣列。

如果您在第一次設定工作流程伺服陣列時未記錄此金鑰，且不知道它是什麼，則應該在離開工作流程伺服器陣列之前重設它。

重要事項

重設憑證產生金鑰也會產生新的工作流程和服務匯流排憑證。您必須採取額外的步驟，以確保 SharePoint 伺服器信任這些新憑證。若無法這麼做，將導致所有 2013 平臺工作流程失敗。

重設金鑰

您可以使用下列 PowerShell 腳本來重設金鑰，但您必須在仍加入工作流程伺服器陣列的 SPWFM 伺服器上執行。如果您在工作流程伺服器陣列中有多個節點/主機，建議您讓其他節點離開伺服器陣列，只留下一個節點，以簡化程式。

# Just provide the new certificate key here, for example P@ssWord1
# MAKE SURE YOU DOCUMENT THIS KEY SOMEWHERE SO YOU DON'T HAVE TO REPEAT THIS EXERCISE
$CertKey = convertto-securestring "[YourPassword]" -asplaintext -force

### You should NOT have to change anything below this line ###
# Set the key for WF
$WFdb = (get-wffarm).wffarmdbconnectionstring
Set-WFCertificateAutoGenerationKey  -WFFarmDBConnectionString $WFdb -key $CertKey -Verbose

# Force the Update on the WF side
Stop-WFHost
Update-WFHost -CertificateAutoGenerationKey $CertKey
"Starting Workflow Farm.  This could take a few minutes..."
Start-WFHost

# Set the key for SB
$SBdb = (get-sbfarm).SBFarmDBConnectionString 
Set-SBCertificateAutogenerationKey -SBFarmDBConnectionString $SBdb -key $CertKey  -Verbose

# Force the Update on the SB side
Stop-Sbfarm
Update-SBHost -CertificateAutoGenerationKey $CertKey
Write-host "Starting Service Bus Farm.  This could take a few minutes..."
Start-SBfarm

# Some steps you need to take on the SharePoint side
Write-host -ForegroundColor yellow "Exporting the new WF endpoint cert to the current directory.  You MUST install this cert on all SharePoint servers."
Write-host "$PWD\WFsslCert.cer"
Get-WFAutoGeneratedCA -CACertificateFileName WFsslCert.cer
Write-host -ForegroundColor yellow "AFTER you have installed $PWD\WFsslCert.cer on your SharePoint servers, you must also run the ""Refresh Trusted Security Token Services Metadata feed"" timer job on the SharePoint side to update the Workflow Outbound certificate."

信任 SharePoint 端的新憑證

如上所述，重設憑證產生金鑰會導致產生新的憑證。這些是 SharePoint 伺服器不信任的自我簽署憑證。您必須採取下列步驟，以確保 SharePoint 伺服器信任新的憑證。

信任所有 SharePoint 伺服器上的新工作流程端點憑證。您可能已經注意到上述 PowerShell 腳本將此憑證匯出至目前目錄作為「WFsslCert.cer」。這是 SharePoint 伺服器需要信任的伺服器。將它複製到每部 SharePoint 伺服器，並將其安裝到受信任的根憑證授權單位存放區。如需詳細步驟，請參閱在 SharePoint 中安裝工作流程管理員憑證。
在任何 SharePoint 伺服器上執行 RefreshMetadataFeed 計時器工作，以重新整理 SPTrustedSecurityTokenIssuer。您可以使用此 PowerShell 來執行此動作：
```
$tj = Get-SPTimerJob | ? {$_.name -match "RefreshMetadataFeed"} 
Start-SPTimerJob $tj
```

共用方式為

重設 SharePoint 工作流程管理員的憑證產生金鑰

重設金鑰

信任 SharePoint 端的新憑證

其他資源