{"id":4037,"date":"2026-06-08T18:02:26","date_gmt":"2026-06-08T15:02:26","guid":{"rendered":"https:\/\/support.withsecure.com\/en\/?post_type=support_article&p=4037"},"modified":"2026-06-08T18:02:26","modified_gmt":"2026-06-08T15:02:26","slug":"withsecure-policy-manager-proxy-gives-error-error-ca-certificate-verification-failed-or-ra-not-issued-by-ca-when-running-fspmp-enroll-tls-certificate-bat","status":"publish","type":"support_article","link":"https:\/\/support.withsecure.com\/fr\/support-articles\/withsecure-policy-manager-proxy-gives-error-error-ca-certificate-verification-failed-or-ra-not-issued-by-ca-when-running-fspmp-enroll-tls-certificate-bat\/","title":{"rendered":"WithSecure Policy Manager Proxy gives error \u00ab\u00a0Error: CA certificate verification failed\u00a0\u00bb or \u00ab\u00a0RA not issued by CA\u00a0\u00bb, when running fspmp-enroll-tls-certificate.bat"},"content":{"rendered":"

Issue:<\/h3>\n

I executed fspmp-enroll-tls-certificate.bat for Policy Manager Proxy and it gives me the error "Error: CA certificate verification failed" or "RA not issued by CA".<\/p>\n

Resolution:<\/h3>\n

This error can occur if the server's Simple Certificate Enrollment Protocol (SCEP) is not up to date. You can follow the steps below on the Policy Manager Server to resolve this:<\/p>\n

    \n
  1. Launch<\/b> Command Prompt as administrator<\/li>\n
  2. Type<\/b> net stop fsms<\/i> and hit Enter <\/b>to stop Policy Manager Server services<\/li>\n
  3. Delete<\/b> the fspms.jks file from the Policy Manager Server installation folder (…\\F-Secure\\Management Server 5\\data)<\/li>\n<\/ol>\n
    Note:<\/b> Make a copy of the fspms.jks file as a backup<\/div>\n
      \n
    1. In Command Prompt, navigate<\/b> to the folder mentioned in Step 3.\u00a0<\/li>\n<\/ol>\n
      e.g. cd C:\\Program Files (x86)\\F-Secure\\Management Server 5\\data\u00a0<\/i><\/div>\n
        \n
      1. Type<\/b> the following command below one after another:\u00a0<\/li>\n<\/ol>\n
        Note: <\/b>When prompted for a password, type: superPASSWORD<\/b><\/div>\n
          \n
        • C:\\Program Files (x86)\\F-Secure\\Management Server 5\\jre\\bin\\keytool.exe" -delete -alias fspm-ra-encryption -keystore fspms-ca.jks<\/li>\n
        • C:\\Program Files (x86)\\F-Secure\\Management Server 5\\jre\\bin\\keytool.exe" -delete -alias fspm-ra-signing -keystore fspms-ca.jks\u00a0<\/li>\n<\/ul>\n
          Note:<\/b> If you installed the Policy Manager in a different directory, specify it accordingly with the command \u00a0above<\/div>\n
            \n
          1. Type<\/b> net start fsms and hit Enter to stop Policy Manager Server services<\/li>\n<\/ol>\n

            Last, you need to run <\/b>the fspmp-enroll-tls-certificate.bat script located in the Policy Manager Proxy Server installation folder. (…\\F-Secure\\Management Server 5\\bin\\fspmp-enroll-tls-certificate.bat), and restart PMP service.<\/p>\n

            For Linux<\/b><\/u><\/p>\n

            The main issue is the CA certificate was updated, but SCEP certificates were not on the Policy Manager.<\/p>\n

            So to fix the issue we should delete Simple Certificate Enrollment Protocol (SCEP) certificates from fspms-ca.jks.
            \u00a0<\/p>\n

            On Policy Manager Server machine:<\/b><\/u><\/p>\n

            \u00a0\u00a0 1) stop FSPMS service;
            \u00a0\u00a0 2) delete fspms.jks ;
            \u00a0\u00a0 3) run under data folder (\/var\/opt\/f-secure\/fspms\/data\/ ) next:
            \u00a0 \u00a0\u00a0\u00a0 – \/opt\/f-secure\/fspms\/jre\/bin\/keytool -delete -alias fspm-ra-encryption -keystore fspms-ca.jks
            \u00a0 \u00a0\u00a0\u00a0 – \u00a0\/opt\/f-secure\/fspms\/jre\/bin\/keytool -delete -alias fspm-ra-signing -keystore fspms-ca.jks ;
            \u00a0\u00a0 4) start FSPMS service<\/p>\n

            On Policy Manager Proxy machine :run fspmp-enrol- tls-certificate script (\/opt\/f-secure\/fspms\/bin\/), and restart PMP service.<\/p>\n","protected":false},"excerpt":{"rendered":"

            Running fspmp-enroll-tls-certificate.bat gives the error \u00ab\u00a0Error: CA certificate verification failed\u00a0\u00bb or \u00ab\u00a0RA not issued by CA\u00a0\u00bb<\/p>\n","protected":false},"template":"","support_article_product":[106],"class_list":["post-4037","support_article","type-support_article","status-publish","hentry"],"acf":{"source_foreign_id":"000012947","source_version":3,"source_system":"salesforce","source_date_updated":"2026-06-08 15:02:26","import_hash":"b5e50877e728cdbc31ffa5200a2f9a6d803e421c","vanilla_article_id":29381,"vanilla_url":"https:\/\/community.withsecure.com\/en\/kb\/articles\/29381-withsecure-policy-manager-proxy-gives-error-error-ca-certificate-verification-failed-or-ra-not-issued-by-ca-when-running-fspmp-enroll-tls-certificate-bat","vanilla_kb_id":30,"vanilla_category_id":103,"machine_translated":false,"reactions_helpful_yes":0,"reactions_helpful_no":0},"_links":{"self":[{"href":"https:\/\/support.withsecure.com\/fr\/wp-json\/wp\/v2\/support_article\/4037","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/support.withsecure.com\/fr\/wp-json\/wp\/v2\/support_article"}],"about":[{"href":"https:\/\/support.withsecure.com\/fr\/wp-json\/wp\/v2\/types\/support_article"}],"wp:attachment":[{"href":"https:\/\/support.withsecure.com\/fr\/wp-json\/wp\/v2\/media?parent=4037"}],"wp:term":[{"taxonomy":"support_article_product","embeddable":true,"href":"https:\/\/support.withsecure.com\/fr\/wp-json\/wp\/v2\/support_article_product?post=4037"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}