How to change Certificate on Hyper-V Replica

Learn how to manually replace a Hyper-V Replica HTTPS certificate, update authentication thumbprints on hosts or clusters, and test replication.

Hyper-V Replica certificate authentication uses mutual TLS. Both sending and receiving hosts need valid certificates, and clustered deployments also use the Hyper-V Replica Broker identity.

Before you begin

The certificate must have a private key, both Client and Server Authentication EKUs, chain to a trusted root, and contain the host FQDN. Clustered nodes also need the Replica Broker FQDN as Microsoft specifies. Record ports, authorization rules, old thumbprints, and replication health.

Step-by-step certificate replacement

Import the replacement into Cert:\LocalMachine\My on every applicable host.

On a standalone receiving host, preserve the current authorization configuration while changing the thumbprint:

Set-VMReplicationServer -ReplicationEnabled $true `
  -AllowedAuthenticationType Certificate `
  -CertificateThumbprint "<thumbprint>" `
  -CertificateAuthenticationPort 443

Update sending VM relationships or cluster Broker configuration wherever the old certificate is selected. In Failover Cluster Manager, update the Replica Broker's Replication Settings and apply the node/Broker certificate requirements.
Repeat node by node and retain the old certificate until replication catches up.

Verify the new certificate

Test-VMReplicationConnection -ReplicaServerName replica.example.com `
  -ReplicaServerPort 443 -AuthenticationType Certificate `
  -CertificateThumbprint <thumbprint>
Get-VMReplication | Format-Table Name,State,Health,LastReplicationTime

Also verify certificate revocation endpoints are reachable from both sides.

Rollback

Restore the old thumbprint in server/Broker and VM relationship settings. Confirm replication resumes before removing the failed replacement.

Common problems

Only Server Authentication EKU is present; Hyper-V Replica requires client and server.
Host or Broker FQDN is absent from SANs.
Cluster nodes have the Broker certificate on only one node.
CRL retrieval fails even though the certificate chain is otherwise trusted.

Automating certificate replacement with aethercert

The aethercert Hyper-V Replica target imports the certificate and configures the local Replica server for certificate authentication. Cluster/Broker scope and remote peers must still be planned across the deployment.

See Deploy targets for the fields this preset takes, what it needs on the host, and how far it has been verified.