請注意，自動化系統用來計算指紋的方法與受管理的 Microsoft AD 儲存指紋的方式之間的任何顯示差異。舉例來說，Managed Microsoft AD 會將指紋儲存為單一未分隔的十六進制字串：771B8FD90806E074A7AD49B1624D2761137557D2。OpenSSL 會針對相同的憑證傳回以下內容：SHA1 Fingerprint=77:1B:8F:D9:08:06:E0:74:A7:AD:49:B1:62:4D:27:61:13:75:57:D2。
[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-04 (世界標準時間)。"],[],[],null,["# Best practices for automating certificate renewal\n\nThis topic describes the best practices for automating certificate renewal for\nLDAPS.\n\nOverview\n--------\n\nIf you are issuing shorter-lived certificates, we recommend that you automate\nthe renewal of these certificates.\n\nDealing with API errors\n-----------------------\n\nAutomation should check for errors both on the initial blocking API call as\nwell as when polling the returned long-running operation. The update can only be\nconsidered as successful if the long-running operation is marked as done without\nerror.\n\nIf `UpdateLdapsSettings` returns an error with code `INVALID_ARGUMENT`, the\nerror message can explain what is wrong with the uploaded certificate. This\nerror is typically returned during the initial blocking call to the API. In such\ncases, retries are ineffective and the automation should send an alert.\n\nIf the API returns any other error code which is retriable (such as\n`UNAVAILABLE`), the automation should retry the call with the appropriate\nbackoff. These errors are typically returned when polling the long-running\noperation that is returned by the initial blocking call to\n`UpdateLdapsSettings`.\n\nLearn more about\n[`UpdateLdapsSettings`](../reference/rest/v1/projects.locations.global.domains/updateLdapssettings).\n\nChecking the `LDAPSSettings` state\n----------------------------------\n\nAfter calling `UpdateLdapsSettings`, it is good practice to check that\n`LDAPSSettings` meets expectations and is in a good state (`ACTIVE`). You can\ncall `GetLdapsSettings` to compare the fingerprints of certificates in the\nintended state against the deployed certificate fingerprints. You can use tools\nlike OpenSSL to calculate the fingerprints of your new certificates.\n\nDo take note of any display differences between the method the automation uses\nto compute fingerprints versus how Managed Microsoft AD stores them.\nFor example, Managed Microsoft AD stores a thumbprint as a single undelimited\nhexadecimal string: `771B8FD90806E074A7AD49B1624D2761137557D2`. OpenSSL returns\nthe following for the same certificate:\n`SHA1 Fingerprint=77:1B:8F:D9:08:06:E0:74:A7:AD:49:B1:62:4D:27:61:13:75:57:D2`.\n\nLearn more about [`LDAPSSettings`](../reference/rest/v1/LDAPSSettings) and\n[`GetLdapsSettings`](../reference/rest/v1/projects.locations.global.domains/getLdapssettings).\n\nBuilding a PFX certificate chain\n--------------------------------\n\nIf your automation procures certificates in the PEM or CRT formats, you must\nconvert them to PFX and include the entire certificate chain.\n\nTo convert to PFX and include the entire chain, complete the following steps\nusing shell and OpenSSL.\n\n1. Create a single PEM file that includes all intermediate certificates as well\n as the root certificate.\n\n ```\n cat root-ca-cert.pem \u003e\u003e temp.pem\n echo -e \"\\n\" \u003e\u003e temp.pem\n cat intermediate-ca-cert.pem \u003e\u003e temp.pem\n ```\n2. Build the output PFX file. `leaf.key` is the private key.\n\n ```\n openssl pkcs12 -export -out out.pfx -inkey leaf.key -in leaf-cert.pem \\\n -certfile temp.pem -passout \"EXPORT_PASSWORD\"\n ```\n3. Show info of the PFX file. This should show the entire root to leaf chain\n and the private key.\n\n ```\n openssl pkcs12 -in out.pfx -nodes -passin \"EXPORT_PASSWORD\"\n ```"]]
