{"id":4434,"date":"2026-06-08T17:52:32","date_gmt":"2026-06-08T14:52:32","guid":{"rendered":"https:\/\/support.withsecure.com\/en\/?post_type=support_article&p=4434"},"modified":"2026-06-08T17:52:32","modified_gmt":"2026-06-08T14:52:32","slug":"client-security-failed-to-download-definition-updates-from-policy-manager-proxy-and-policy-manager-server-with-certificate-expired-and-untrusted-root-ca-errors","status":"publish","type":"support_article","link":"https:\/\/support.withsecure.com\/en\/support-articles\/client-security-failed-to-download-definition-updates-from-policy-manager-proxy-and-policy-manager-server-with-certificate-expired-and-untrusted-root-ca-errors\/","title":{"rendered":"Client Security failed to download definition updates from Policy Manager Proxy and Policy Manager Server with “certificate expired” and “untrusted root ca” errors."},"content":{"rendered":"

Issue:<\/h3>\n

This article applies to the following WithSecure products: Policy Manager Server, Policy Manager Proxy<\/p>\n

The Client Security failed to download definition updates from Policy Manager Proxy (PMP) and Policy Manager Server (PMS) with "certificate expired" and "untrusted root ca" errors.<\/p>\n

Host using PMP<\/b><\/u>
2022-02-01 09:32:21.040 [1454.1a68] I: Checking for updates from\u00a0https:\/\/xxxx.xxxxx.xxxxx.de:488\/guts2<\/a>
2022-02-01 09:32:21.040 [1454.1a68] I: Update check failed, error=221 (certificate expired)<\/p>\n

Host using PMS directly<\/b><\/u>
2022-01-31 16:32:22.806 [0f54.1300] I: Checking for updates from\u00a0https:\/\/xxxxx.xxxxx.xxx.de:443\/guts2<\/a>
2022-01-31 16:32:22.884 [0f54.1300] I: Update check failed, error=216 (untrusted root ca)<\/p>\n

The problem occurred after updating to Policy Manager Server 15.30<\/p>\n

Resolution:<\/h3>\n

Based on data from the Java KeyStore (.jks) files, the certificates on the Policy Manager Proxy was renewed, however, it was not included in the logs. The CA certificate was updated, however, SCEP certificates were not.<\/p>\n

You can delete the SCEP certificates from fspms-ca.jks to fix the issue.<\/p>\n

For Policy Manager installed on a Linux host:\u00a0:<\/b><\/p>\n

    \n
  1. Stop<\/b> the WithSecure Policy Manager service<\/li>\n
  2. Delete<\/b> the fspms.jks file<\/li>\n
  3. Run<\/b> the following command folder under data folder (\/var\/opt\/f-secure\/fspms\/data\/)<\/li>\n<\/ol>\n
      \n
    • \/opt\/f-secure\/fspms\/jre\/bin\/keytool -delete -alias fspm-ra-encryption -keystore fspms-ca.jks<\/li>\n
    • \/opt\/f-secure\/fspms\/jre\/bin\/keytool -delete -alias fspm-ra-signing -keystore fspms-ca.jks<\/li>\n<\/ul>\n
        \n
      1. Start<\/b> WithSecure Policy Manager service<\/li>\n
      2. On the Policy Manager Proxy machine, run<\/b> the fspmp-enroll-tls-certificate script from \/opt\/f-secure\/fspms\/bin\/\u00a0<\/li>\n<\/ol>\n

        For Policy Manager installed on a Windows host:<\/b><\/p>\n

          \n
        1. Stop<\/b> the WithSecure Policy Manager Server\u00a0service from services.msc > F-Secure Policy Manager Server<\/li>\n
        2. Delete<\/b> the fspms.jks in %ProgramData%\\WithSecure\\NS\\Policy Manager\\Policy Manager Server\\data\u00a0\u00a0Note: Make a backup of this file<\/b><\/li>\n
        3. Launch<\/b> Command Prompt as administrator<\/li>\n
        4. Navigate<\/b> to\u00a0%ProgramData%\\WithSecure\\NS\\Policy Manager\\Policy Manager Server\\data folder in the Command Prompt<\/li>\n
        5. Run <\/b>the following command:<\/li>\n<\/ol>\n
            \n
          • "C:\\Program Files\\WithSecure\\Policy Manager\\jre\\bin\\keytool.exe" -delete -alias fspm-ra-encryption -keystore fspms-ca.jks<\/li>\n
          • "C:\\Program Files\\WithSecure\\Policy Manager\\jre\\bin\\keytool.exe" -delete -alias fspm-ra-signing -keystore fspms-ca.jks\u00a0<\/li>\n<\/ul>\n
              \n
            1. Start<\/b> the WithSecure Policy Manager Server service from services.msc<\/li>\n
            2. Upon launching the Policy Manager Console, you will be prompted to accept the new certificate. You can click Accept<\/b> to continue<\/li>\n
            3. Run<\/b> the fspmp-enrol- tls-certificate.bat script on the Policy Manager Proxy machine.<\/li>\n<\/ol>\n
                \n
              • (…\\F-Secure\\Management Server 5\\bin\\fspmp-enroll-tls-certificate.bat)<\/li>\n<\/ul>\n

                Once the steps above are completed, the definition updates should work as expected.\u00a0<\/p>\n","protected":false},"excerpt":{"rendered":"

                Host installed with the Client Security fails to download definition updates from Policy Manager Proxy and Policy Manager Server with “certificate expired” and “untrusted root ca” errors<\/p>\n","protected":false},"template":"","support_article_product":[104],"class_list":["post-4434","support_article","type-support_article","status-publish","hentry"],"acf":{"source_foreign_id":"000014283","source_version":3,"source_system":"salesforce","source_date_updated":"2026-06-08 14:52:32","import_hash":"bc6fbf7f2d3aee369dd918fa961150c373c22c99","vanilla_article_id":29331,"vanilla_url":"https:\/\/community.withsecure.com\/en\/kb\/articles\/29331-client-security-failed-to-download-definition-updates-from-policy-manager-proxy-and-policy-manager-server-with-certificate-expired-and-untrusted-root-ca-errors","vanilla_kb_id":30,"vanilla_category_id":106,"machine_translated":false,"reactions_helpful_yes":0,"reactions_helpful_no":0},"_links":{"self":[{"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/support_article\/4434","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/support_article"}],"about":[{"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/types\/support_article"}],"wp:attachment":[{"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/media?parent=4434"}],"wp:term":[{"taxonomy":"support_article_product","embeddable":true,"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/support_article_product?post=4434"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}