Automated Certificate rotation

BPMikeLawrence — Wed, 05 Aug 2026 16:17:13 GMT

As part of our ongoing commitment to platform security, compliance, and zero-trust architecture, SS&C Blue Prism is updating our recommendations regarding enterprise certificate management policies. Driven by evolving industry standards and regulatory shifts—such as the CA/Browser Forum requirements—cryptographic certificate lifecycles are shrinking dramatically through a phased, multi-year approach:

March 15, 2026: Maximum validity drops to 200 days (currently in effect).
March 15, 2027: Further reduction down to 100 days.
March 15, 2029: Final enforcement step down to a maximum duration of 47 days.

To align with this timeline and safeguard our customers’ application ecosystems, Blue Prism Professional Services have developed two scripts to streamline certificate rotation in the BPE and Hub applications.

For Blue Prism Enterprise

If customers utilize either of the following connection modes:

WCF: SOAP with Transport Encryption & Windows Authentication
WCF: SOAP with Transport Encryption

Then certificates are required to secure those respective connection modes.

In some cases, administrators may run multiple services on a single server. Consequently, the scripts can be configured to run on an unlimited number of service \ port combinations.

Because a Blue Prism Server Service restart is required to complete the process, Blue Prism recommends executing this procedure within a scheduled monthly maintenance window.

Script Description

Validation & Checks:

Certificate Check: Verifies that the new certificate (identified by its unique thumbprint) exists in the local machine's certificate store. If unsuccessful, it halts execution and lists the available certificates.
Service Check: Confirms that all targeted Blue Prism Windows services exist on the machine prior to initiating any changes.

Safe Shutdown:

Temporarily stops the target Blue Prism Server services to release their port bindings, ensuring a clean update free from file locks or conflicts.

Port Binding Update:

Removes the old certificate binding from the designated ports (e.g., ports 8199 and 8200).
Binds the new certificate to those ports using the provided certificate thumbprint.

Service Restart & Verification:

Restarts all targeted Blue Prism Server services in parallel.
Verifies that the ports are successfully bound to the new certificate.
Actively monitors the services until they report a running status (incorporating built-in timeout safety checks).

Final Reporting:

Outputs a clear summary indicating whether all steps, bindings, and service recoveries have completed successfully.

For Blue Prism Hub

The Blue Prism Hub installation creates numerous websites. Typically, all websites are bound to a single certificate, which is also commonly shared by the Blue Prism API.

The script updates the certificate bindings for each website (including the BP API) and also grants the BP API the necessary permissions to manage the certificate's private keys.

Note that the script requires initial setup to configure the Hub website names and application pools.

Script Description

Certificate Verification & Permissions:

Locates the new certificate in the local certificate store using its unique thumbprint.
Automatically grants the Blue Prism API Application Pool ("Blue Prism API - Main") the required full control security permissions over the certificate's private key file, ensuring the API can safely authenticate and run.

Target Identification:

Scans IIS for any websites matching standard Blue Prism Hub component patterns (such as Audit, Control Room, Dashboard, Gateway, Interact, and others).

Certificate Binding & Updates:

Loops through all identified Hub websites.
If an existing HTTPS binding is found on port 443, it updates it with the new certificate.
If an HTTPS binding does not yet exist on a matching site, it creates a new secure binding and assigns the certificate to it.

Completion Report:

Provides a clear console log verifying that all targeted websites have been updated successfully with the new certificate.

Out of Scope / Manual Considerations

The scripts do not currently automate the following:

Certificates on Load Balancers:

These updates must be performed manually.

Instructional Communication Configuration, (/sslcert configuration in the resource PC startup parameters & Login Agent configuration)
- These tasks are best managed via an enterprise configuration management tool.

Where are the scripts available?

To ensure the correct usage and configuration it is recommended that customers raise a Knowledge Support Session under the category:

Technology - Enhancing Security

State clearly in the session notes that the session is for the certificate rotation scripts.

This will allow a Professional Services representative to guide customers through the initial configuration required.

A Knowledge Support session can be raised here:

Knowledge Support Booking Portal | Blue Prism Portal

topic Automated Certificate rotation in Product Forum

Automated Certificate rotation