Skip to content
Docs sslbrain sslbrain.com

SharePoint Server Subscription Edition

Copy link to the page “SharePoint Server Subscription Edition”

← All integrations

Windows · Web server

Installs and renews certificates on selected HTTPS zones through SharePoint farm certificate management.

The service agent on the server fetches the task from the appliance over outbound HTTPS on port 443 and installs the certificate locally on the server. The appliance never connects to the server.

What happens

  1. The service agent on the server fetches the task from the appliance over outbound HTTPS, port 443.
  2. Discovery distinguishes Subscription Edition from SharePoint 2016/2019, finds farm certificates and HTTPS zones and correlates bindings with the fingerprint actually served by each web server. Select unambiguous discovery targets; SelectedTargets uses farm GUID/web application GUID/zone.
  3. The agent checks the PFX, private key and candidate fingerprint, records selected binding settings and retains old farm certificates. Import-SPCertificate distributes the candidate through SharePoint to the farm servers.
  4. Set-SPWebApplication changes only selected existing HTTPS zones and preserves port, host header, URL, SNI and version-specific TLS settings. Renewal uses the same targets. It makes no direct IIS change or global Switch-SPCertificate call, which would replace every use of the certificate.
  5. Verify reads farm bindings back and performs fresh TLS handshakes directly with web servers using the zone’s concrete hostname as SNI. The served fingerprint must match the candidate. Deployment’s own activation and in-run verification trigger automatic rollback on failure. The separate verify action reads and tests without changing bindings. If it fails: Rollback restores only bindings that still match the recorded before or after state. Later administrator changes are preserved. Partial farm failures, unknown mutation outcomes and failed rollback are reported with redacted logs without secrets.

Technical details

Connection
The package runs through the service agent on the server. The agent connects over outbound HTTPS to the appliance, port 443 by default. You open no port into the server.
Service ports
443
You need
The service agent installed on the server. Install the Windows service agent on a SharePoint server with SharePoint Management Shell and farm access and local Administrators membership. The account must be able to import farm certificates and change web application bindings. The server must reach each participating web server on the zone’s HTTPS port.
Platform
SharePoint Server Subscription Edition on Windows Server 2019, 2022 and 2025
Actions
Discovery, Installation, Verification, Rollback
Packages
sharepoint-se
Note
  • SharePoint 2016 and 2019 use iis8plus on each web server. sharepoint-se changes only existing HTTPS web application zones in Subscription Edition; SMTP, STS, OIDC and Central Administration are outside this integration.
  • TLS uses Windows hostname and chain validation. Optional MANAGEMENT_TLS_PIN_SHA256 instead pins the existing certificate’s complete DER fingerprint; deployment verification uses the candidate’s new pin. The management_tls_trust_update result gives the new fingerprint. Save it as MANAGEMENT_TLS_PIN_SHA256 before the next discovery or renewal. The certificate and PFX password travel through protected service-agent input, never command-line arguments or URLs.
  • Customer selection transfers SharePoint certificate assignment for those zones to sslbrain. External renewal jobs are reported as unknown; the agent does not inventory their scheduler state, and they are not deleted or disabled. Coordinate any other renewal job for the same service. Results identify changed targets. Shared TLS bindings require all affected zones to be selected.
  • SharePoint controls farm certificate distribution. An interrupted native process can leave an unknown mutation outcome; fresh discovery and the recorded binding backup support scoped recovery. Old certificates are retained after renewal.

Certificate requirements

Key types: RSA and ECC. sslbrain offers RSA 2048, 3072 and 4096 bits and ECDSA P-256 and P-384. New-SPCertificate can generate RSA 2048/4096/8192/16384 and P-256/P-384/P-521; Microsoft discourages sizes above RSA 4096 and P-384. These are CSR choices, not documented import limits. Import minimum, maximum and exhaustive curve limits are undocumented.

CN is required for SharePoint’s own CSR generation. A CN requirement for PFX imports and specific acceptance of CN-less Let’s Encrypt tlsserver and Google minimal certificates are undocumented. The checked HTTPS sources do not explicitly require clientAuth EKU or universal keyEncipherment KU; SMTP rules do not apply here. The new certificate is checked through actual TLS for the selected service.

SAN: SharePoint CSRs support DNS and IP. Import limits for wildcard certificates, IP SANs and SAN count are undocumented. Wildcard host headers require SE 23H1 Early Release or 23H2 Standard Release and are distinct from wildcard certificates. Discovery uses the existing binding and a concrete SNI hostname.

Format: The agent supplies PFX/PKCS12 with one private key, matching leaf and chain. SharePoint also imports P7B/PKCS7 and CER, which do not carry the private key for the web binding. Direct PEM key pairs and JKS are not documented SharePoint inputs and must be converted before import; these sources do not specify CER PEM/DER encoding.

PFX encryption: SharePoint export documents AES256/SHA256 on Windows Server 2019 onwards and TripleDES/SHA1 for older Windows. This does not establish every import variant. RC2 and precise AES import limits are undocumented; 3DES support does not prove RC2 support.

Chain: The full chain from leaf through root must be imported into SharePoint. A root in the farm does not mean it must be sent in the TLS handshake. Certificate order inside the PFX container is undocumented. The web certificate must have its private key and reside in EndEntity.

Friendly name is an administrative label. Maximum length, allowed characters and PFX alias rules are undocumented. The agent selects by GUID and fingerprint, not friendly name. SharePoint’s minimum and maximum certificate lifetime are undocumented; the CA determines issued validity. Windows TLS validates validity and chain, while pinning checks the selected leaf pin.

Get started