{"id":4227,"date":"2026-06-08T18:00:07","date_gmt":"2026-06-08T15:00:07","guid":{"rendered":"https:\/\/support.withsecure.com\/en\/?post_type=support_article&#038;p=4227"},"modified":"2026-06-08T18:00:07","modified_gmt":"2026-06-08T15:00:07","slug":"how-to-replace-the-default-self-signed-policy-manager-certificate-with-a-trusted-certificate-authority-ca-created-certificate","status":"publish","type":"support_article","link":"https:\/\/support.withsecure.com\/en\/support-articles\/how-to-replace-the-default-self-signed-policy-manager-certificate-with-a-trusted-certificate-authority-ca-created-certificate\/","title":{"rendered":"How to replace the default self-signed Policy Manager certificate with a trusted certificate authority (CA) created certificate?"},"content":{"rendered":"<h3>Issue:<\/h3>\n<p>How can I replace the default self-signed Policy Manager certificate with a trusted certificate authority (CA) created certificate?<\/p>\n<h3>Resolution:<\/h3>\n<p>Assume that you have:<\/p>\n<ul>\n<li>The signed or maybe self-signed certificate (with full chain of intermediate CA) and private key for it inside PKCS12 Keystore.<\/li>\n<li>It is protected with password &quot;<i>srcpassword<\/i>&quot;<\/li>\n<li>Your certificate and the private key are referenced by name (alias) &quot;<i>server<\/i>&quot;.<\/li>\n<li>The Keystore file is &quot;<i>server.p12<\/i>&quot; and it is located in the same directory as &quot;<i>fspms.jks<\/i>&quot;.<\/li>\n<\/ul>\n<p>Steps to replace the default Policy Manager certificate:<\/p>\n<ol>\n<li>Launch an elevated command prompt<\/li>\n<li>Change the default folder to the directory where &quot;fspms.jks&quot; and import the new trusted certificate using the following commands:\n<ul>\n<li><span style=\"font-family: Courier New,Courier,monospace;\"><i><strong>Policy Manager 15.x:<\/strong> <\/i><\/span><\/li>\n<li><span style=\"font-family: Courier New,Courier,monospace;\">cd\u00a0<i>&quot;C:\\Program Files (x86)\\F-Secure\\Management Server 5\\data&quot;<\/i><\/span><\/li>\n<li><span style=\"font-family: Courier New,Courier,monospace;\"><i>&quot;C:\\Program Files (x86)\\F-Secure\\Management Server 5\\jre\\bin\\keytool&quot; -importkeystore<\/i>\u00a0<i>-destkeystore fspms.jks -deststorepass superPASSWORD -destalias fspms -destkeypass superPASSWORD<\/i>\u00a0<i>-srckeystore server.p12 -srcstoretype PKCS12 -srcstorepass srcpassword -srcalias server<\/i><\/span><\/li>\n<li><strong><span style=\"font-family: Courier New,Courier,monospace;\">Policy Manager 16.x:\u00a0<\/span><\/strong><\/li>\n<li><span style=\"font-family: Courier New,Courier,monospace;\">cd &quot;C:\\ProgramData\\WithSecure\\NS\\Policy Manager\\Policy Manager Server\\data&quot;<\/span><\/li>\n<li><span style=\"font-family: Courier New,Courier,monospace;\"><i>&quot;C:\\Program Files\\WithSecure\\Policy Manager\\jre\\bin\\keytool&quot; -importkeystore<\/i>\u00a0<i>-destkeystore fspms.jks -deststorepass superPASSWORD -destalias fspms -destkeypass superPASSWORD<\/i>\u00a0<i>-srckeystore server.p12 -srcstoretype PKCS12 -srcstorepass srcpassword -srcalias server<\/i><\/span><\/li>\n<\/ul>\n<\/li>\n<li>You are replacing the certificate in &quot;fspms.jks&quot; so the following message will appear:\n<ul>\n<li><i><span style=\"font-family: Arial,Helvetica,sans-serif;\">Existing entry alias server exists, overwrite? [no]:<\/span><\/i><\/li>\n<\/ul>\n<\/li>\n<li>Type &quot;yes&quot; and hit enter.<\/li>\n<li>Restart the Policy Manager server to start using the new certificate.\u00a0Use a Command Prompt to run the commands:\n<ul>\n<li>Policy Manager 15: <strong><span style=\"font-family: Courier New,Courier,monospace;\">net stop fsms<\/span><\/strong> and <strong><span style=\"font-family: Courier New,Courier,monospace;\">net start\u00a0fsms<\/span><\/strong><\/li>\n<li>Policy Manager 16: <strong><span style=\"font-family: Courier New,Courier,monospace;\">net stop wspms<\/span><\/strong> and <strong><span style=\"font-family: Courier New,Courier,monospace;\">net start wspms<\/span><\/strong><\/li>\n<\/ul>\n<\/li>\n<\/ol>\n<p><b>NOTE<\/b>: When you execute the importkeystore command pay attention to &quot;-destkeypass&quot;, it should be the same as &quot;-deststorepass&quot;. If you forget to insert proper &quot;-destkeypass&quot;, the command can complete successfully but problems on Policy Manager server startup may occur.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Steps to replace default self-signed Policy Manager certificate with a trusted certificate authority (CA) created certificate<\/p>\n","protected":false},"template":"","support_article_product":[106],"class_list":["post-4227","support_article","type-support_article","status-publish","hentry"],"acf":{"source_foreign_id":"000014183","source_version":3,"source_system":"salesforce","source_date_updated":"2026-06-08 15:00:07","import_hash":"dd7962208ec23babdd8413542ff54994921bee4a","vanilla_article_id":32384,"vanilla_url":"https:\/\/community.withsecure.com\/en\/kb\/articles\/32384-how-to-replace-the-default-self-signed-policy-manager-certificate-with-a-trusted-certificate-authority-ca-created-certificate","vanilla_kb_id":30,"vanilla_category_id":103,"machine_translated":false,"reactions_helpful_yes":0,"reactions_helpful_no":0},"_links":{"self":[{"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/support_article\/4227","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/support_article"}],"about":[{"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/types\/support_article"}],"wp:attachment":[{"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/media?parent=4227"}],"wp:term":[{"taxonomy":"support_article_product","embeddable":true,"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/support_article_product?post=4227"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}