Extending Your Local Installation Certificate Lifetime

2Feb, 2026

Extending Your Local Installation Certificate Lifetime

I had to create a new local development environment for Sitecore XP today, which will be our last before moving to Sitecore AI. Now, I know I need these environments for at least a couple of years, and the installation certificates will expire before then. I loath changing all the thumbprints and dealing with new certs, so I plan to change the expiration date during installation.

My first thought would be to just modify the createcert.json file that comes with the installation. Seems logical, right? Just add the following line to the cert creation:

"NotAfter": "[DateTime]::Now.AddYears(10)]"

Of course, it’s just my luck this parameter doesn’t exist. I still want that sweet laziness of not renewing these certs so I’m digging deeper.

Modifying Sitecore Installation Framework

I’m just going to jump into the scripts that support this installation and find what I need. Under the Program Files\WindowsPowerShell\Modules\ you should see the Sitecore installer.

Under Public -> Tasks there are these two files which look promising:

Invoke-NewRootCertificateTask.ps1
Invoke-NewSignedCertificateTask.ps1

I still don’t see what I’m looking for. Running a search in the whole SIF directory for “.AddDays(“ (because it's fast an easy) brings be to the Certificates.ps1 under the Private folder.

Here, I can see the Root certificate has a 10 year expiration date and the others would have a 2 year one. I simply change it to a value of 3650 and run my installation:

if ($Signer){
    ...
    $certificate.Issuer = $issuer
    $certificate.SignerCertificate = $signerCertificate
    $certificate.NotAfter = ($date).AddDays(730)
    $certificate.X509Extensions.Add($webserverEnhancedKeyUsage)
    $certificate.X509Extensions.Add($webserverBasicKeyUsage)
    ...
} else {
    ...
    $certificate.Issuer = $subjectDN #Same as subject for root CA
    $certificate.NotAfter = ($date).AddDays(3650)
    $certificate.X509Extensions.Add($rootEnhancedKeyUsage)
    $certificate.X509Extensions.Add($basicConstraints)
    ...
}

And now I don’t have to worry about expiration any time soon. Yay!