Lately I had the issue that SolarWinds Orion was detecting an expiring certificate on one of our servers. I have replaced every certificate on the server and double checked (of thought!) that the old certificate was deleted. But it was still complaining about an expiring date on a certificate I couldn’t find. I checked the event logs and found the event 15021, which told me something was still wrong.

I found out that a certificate was on a binding with “netsh show http certssl” in a command prompt.

It was resolved by doing the following.

1. Open a CMD.exe.
2. Execute “netsh http show sslcert“, and got the following back.
   
   SSL Certificate bindings: ------------------------- IP:port : 0.0.0.0:443 Certificate Hash : <old hash> Application ID : {f955c070-e044-456c-ac00-e9e4275b3f04} Certificate Store Name : (null) Verify Client Certificate Revocation : Enabled Verify Revocation Using Cached Client Certificate Only : Disabled Usage Check : Enabled Revocation Freshness Time : 0 URL Retrieval Timeout : 0 Ctl Identifier : (null) Ctl Store Name : (null) DS Mapper Usage : Disabled Negotiate Client Certificate : Disabled

   1 2 3 4 5 6 7 8 9 10 11 12 13 14 15

   SSL Certificate bindings: -------------------------     IP:port                      : 0.0.0.0:443     Certificate Hash             : <old hash>     Application ID               : {f955c070-e044-456c-ac00-e9e4275b3f04}     Certificate Store Name       : (null)     Verify Client Certificate Revocation : Enabled     Verify Revocation Using Cached Client Certificate Only : Disabled     Usage Check                  : Enabled     Revocation Freshness Time    : 0     URL Retrieval Timeout        : 0     Ctl Identifier               : (null)     Ctl Store Name               : (null)     DS Mapper Usage              : Disabled     Negotiate Client Certificate : Disabled

   
    
3. Note down the old configuraiton and delete the binding with “netsh http delete sslcert ipport=0.0.0.0:443“.
4. Add it again with “netsh http add sslcert ipport=0.0.0.0:443 certhash=<new hash> appid=”{f955c070-e044-456c-ac00-e9e4275b3f04}”“.

Now the error is gone from the event log and Orion!

That’s all from now.