{"id":4231,"date":"2026-06-08T18:00:05","date_gmt":"2026-06-08T15:00:05","guid":{"rendered":"https:\/\/support.withsecure.com\/en\/?post_type=support_article&#038;p=4231"},"modified":"2026-06-08T18:00:05","modified_gmt":"2026-06-08T15:00:05","slug":"how-to-replace-default-self-signed-policy-manager-linux-certificate-with-trusted-ca-created-certificate","status":"publish","type":"support_article","link":"https:\/\/support.withsecure.com\/jp-ja\/support-articles\/how-to-replace-default-self-signed-policy-manager-linux-certificate-with-trusted-ca-created-certificate\/","title":{"rendered":"How to replace default self-signed Policy Manager Linux certificate with trusted CA created certificate"},"content":{"rendered":"<h3>Issue:<\/h3>\n<p>How can I replace the default self-signed Policy Manager Linux certificate with trusted CA created certificate?<\/p>\n<h3>Resolution:<\/h3>\n<p>The Policy Manager for Linux keystore is located inside &quot;\/var\/opt\/f-secure\/fspms\/data\/fspms.jks&quot; (version 12.30 and higher) or &quot;\/opt\/f-secure\/fspms\/config\/fspms.jks&quot; for previous Policy Manager versions.<\/p>\n<p>You can<b> use<\/b> the following command to query details about certificates stored in fspms.jks:<\/p>\n<ul>\n<li><span style=\"font-family: Arial,Helvetica,sans-serif;\">\/opt\/f-secure\/fspms\/jre\/bin\/keytool -list -v -keystore fspms.jks -storepass superPASSWORD<\/span><\/li>\n<li><span style=\"font-family: Arial,Helvetica,sans-serif;\">You should see the following output:<\/span><\/li>\n<\/ul>\n<div style=\"margin-left: 40px;\">Keystore type: JKS<br \/>Keystore provider: SUN<\/p>\n<p>Your keystore contains 1 entry<\/p>\n<p>Alias name: fspms<br \/>Creation date: 20.09.2010<br \/>Entry type: PrivateKeyEntry<br \/>Certificate chain length: 1<br \/>Certificate[1]:<br \/>Owner: CN=f-secure.com, OU=f-secure.com, O=f-secure.com, C=EN<br \/>Issuer: CN=f-secure.com, OU=f-secure.com, O=f-secure.com, C=EN<br \/>Serial number: 4c977fcc<br \/>Valid from: Mon Sep 20 18:37:48 EEST 2010 until: Wed Aug 27 18:37:48 EEST 2110<br \/>Certificate fingerprints:<br \/>\u00a0MD5: 00:2D:4E:23:3A:9C:68:22:CD:CE:72:43:2B:CC:98:00<br \/>\u00a0SHA1: 7C:F7:E1:2D:2E:6C:0A:86:66:53:E2:C7:59:2C:F2:9E:89:B6:4F:BD<br \/>\u00a0SHA256: 02:87:BD:AF:BB:2B:F2:BB:13:A5:96:A8:F1:5D:DC:5C:67:AB:77:68:AF:36:85:1F:F2:F7:DE:29:88:AD:DF:D1<br \/>\u00a0Signature algorithm name: SHA1withDSA<br \/>\u00a0Version: 3<\/div>\n<p>You can follow the steps below to replace the default self-signed Policy Manager Linux certificate:<\/p>\n<p>Assume that you have:<\/p>\n<ul>\n<li>The signed or maybe self-signed certificate (with full chain of intermediate CA) and private key for it inside PKCS12 keystore.<\/li>\n<li>It is protected with password &quot; srcpassword &quot;<\/li>\n<li>Your certificate and the private key are referenced by name (alias) &quot; server &quot;.<\/li>\n<li>The keystore file is &quot; server.p12 &quot; and it is located in the same directory as &quot; fspms.jks &quot;.<\/li>\n<\/ul>\n<p><span style=\"font-family: lucida sans unicode,lucida grande,sans-serif;\"><b>NOTE: <\/b><span style=\"font-family: Arial,Helvetica,sans-serif;\">When you execute importkeystore command pay attention to &quot;-destkeypass&quot;, it should be same as &quot;-deststorepass&quot;. If you forget to insert proper &quot;-destkeypass&quot; command can complete successfully but problems on Policy Manager server startup may occur.<\/span><\/span><\/p>\n<ol>\n<li><b>Type<\/b> the following command:<\/li>\n<\/ol>\n<ul>\n<li><span style=\"font-family: Arial,Helvetica,sans-serif;\">\/opt\/f-secure\/fspms\/jre\/bin\/keytool -importkeystore -destkeystore fspms.jks -deststorepass superPASSWORD\u00a0-destalias fspms -destkeypass superPASSWORD\u00a0-srckeystore server.p12 -srcstoretype PKCS12 -srcstorepass srcpassword -srcalias server<\/span><\/li>\n<\/ul>\n<ol start=\"2\">\n<li>You are replacing certificate in &quot;fspms.jks&quot; so following message will appear:<\/li>\n<\/ol>\n<ul>\n<li><span style=\"font-family: Arial,Helvetica,sans-serif;\">Existing entry alias server exists, overwrite? [no]:<\/span><\/li>\n<\/ul>\n<ol start=\"3\">\n<li><b>Type <\/b>&quot;yes&quot; and <b>hit<\/b> enter<\/li>\n<li><b>Type <\/b>the following command to restart the Policy Manager server to start using the new certificate:<\/li>\n<\/ol>\n<ul>\n<li><span style=\"font-family: Arial,Helvetica,sans-serif;\">\/etc\/init.d\/fspms restart<\/span><\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>Steps to replace default self-signed Policy Manager Linux certificate with trusted CA created certificate<\/p>\n","protected":false},"template":"","support_article_product":[106],"class_list":["post-4231","support_article","type-support_article","status-publish","hentry"],"acf":{"source_foreign_id":"000005655","source_version":3,"source_system":"salesforce","source_date_updated":"2026-06-08 15:00:05","import_hash":"4350bd64a488221ff31b4c063747edb902681aba","vanilla_article_id":32385,"vanilla_url":"https:\/\/community.withsecure.com\/en\/kb\/articles\/32385-how-to-replace-default-self-signed-policy-manager-linux-certificate-with-trusted-ca-created-certificate","vanilla_kb_id":30,"vanilla_category_id":103,"machine_translated":false,"reactions_helpful_yes":0,"reactions_helpful_no":0},"_links":{"self":[{"href":"https:\/\/support.withsecure.com\/jp-ja\/wp-json\/wp\/v2\/support_article\/4231","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/support.withsecure.com\/jp-ja\/wp-json\/wp\/v2\/support_article"}],"about":[{"href":"https:\/\/support.withsecure.com\/jp-ja\/wp-json\/wp\/v2\/types\/support_article"}],"wp:attachment":[{"href":"https:\/\/support.withsecure.com\/jp-ja\/wp-json\/wp\/v2\/media?parent=4231"}],"wp:term":[{"taxonomy":"support_article_product","embeddable":true,"href":"https:\/\/support.withsecure.com\/jp-ja\/wp-json\/wp\/v2\/support_article_product?post=4231"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}