Certificate warning when logging on to the Enterprise Server – deploying the root certificate or adding your own certificate

As of version 18, the connection between Password Depot clients and the Enterprise Server is always encrypted via SSL/TLS; this encryption cannot be disabled. For this purpose, the server automatically creates a self-signed default certificate, signed by its own locally generated certification authority ("Password Depot Server CA"). Because the client computers do not know this certification authority at first, they display a certificate warning at logon. Certificate validation has become stricter as of version 18.0.7 and can no longer be suppressed in version 19. The warning is therefore not an error – it disappears permanently as soon as you implement one of the two following approaches. The warning also reappears after migrating to a new main version, because the new installation generates a new default certificate.

Option A: Install the bundled root certificate on the clients (standard approach)

1. On the server, open the CA subfolder of the program directory: C:\Program Files\AceBIT\Password Depot Server 19\CA.

2. Copy the root certificate file with the .crt extension (its file name ends in _CA, e.g. default_CA.crt) to the client computers.

3. There, install the certificate as administrator into the Trusted Root Certification Authorities store – by double-clicking the file or via the command line:
   certutil -addstore "ROOT" <root_certificate_filename> (machine store, applies to all users) or
   certutil -user -addstore "ROOT" <root_certificate_filename> (current user only).

4. In domain environments, deploy the certificate centrally via Group Policy (GPO) to the same store.

5. Install the root certificate on all computers that connect to the server – including the machine running the Server Manager.

Note: Distribute the .crt file only. The .pfx and .key files also stored in the CA folder contain the certification authority's private key and must not leave the server.

Option B: Add your own certificate

Alternatively, add your own certificate, for example from your internal PKI or from a public certification authority:

1. In the Server Manager, open Manage → Server Certificates. The dialog contains the tabs Main Server and REST Server / HTTPS.

2. On each tab, select the appropriate format: Use PEM files (certificate and private key separately) – with Certificate file (.crt, .pem), Private key file (.key, .pem), and, if applicable, Private key password (if encrypted) – or Import from PFX/PKCS#12 file with PFX file (.pfx, .p12) and PFX password. By default, the files are expected in the Cert subfolder of the program directory.

3. For the REST server, you can enable the option Use the same certificate as for the main server if both are reachable under the same hostname.

4. Make sure that the certificate file contains the complete chain including intermediate certificates (full chain) and that the private key matches the certificate. The CN or SAN must cover all names the clients use to address the server (an FQDN such as server.company.local and/or an IP address). Wildcard certificates are valid for one level only.

5. Then restart the PD_Service_19 service so that the certificate becomes active.

Note: If the certificate or the private key is faulty, or if the two do not match, the server falls back to its default certificate after the service restart without an error message – the certificate warning then persists. After the restart, check under Manage → Server Certificates which certificate is active. Details on certificate errors are available via Tools → System Log (Windows Event Log).

Related topics:

• Creating or renewing the server certificate in version 19 (CNG)

• How do I migrate the Enterprise Server to version 19?

• Connection to the Enterprise Server fails (Socket Error 10060/10061/11001) – checklist

• Which firewall settings are required on the Enterprise Server & Windows client?