In version 19, the Enterprise Server uses the Windows-native cryptography interface CNG ("Microsoft Software Key Storage Provider") for certificates instead of OpenSSL. The easiest way to create and renew server certificates is the integrated wizard in the Server Manager: on request, it generates a self-signed root certificate (Root CA) and uses it to sign server certificates for the main server (TCP) and the REST server (HTTPS).
Creating a new certificate with the wizard
Start the wizard via Tools → Create Server Certificate.
In the first step, select the root certificate option: Create a new root certificate (creates a self-signed root certificate/Root CA) or Use an existing root certificate (recommended). Specify an existing root certificate as a PFX/PKCS#12 file (.pfx, .p12) or as separate PEM files (.pem, .crt, .key); the default path points to the
CAfolder in the program directory. You need the private key and its password.On the Create Server Certificate page, enter the certificate data. The Common Name (CN) must match the hostname or IP address that the clients use to connect; set the Validity (years) here.
On the Subject Alternative Names (SAN) page, review and supplement the DNS Names and IP Addresses under which the server should be reachable (pre-filled:
localhost, server name, DNS hostname, FQDN, and all local IP addresses). Then click Generate.Finally, select the installation options Install for Password Depot Server (TCP port …) and/or Install for REST API Server (HTTPS port …) and click Finish.
Restart the PD_Service_19 service so that the new certificate becomes active, and install the root certificate on all connecting computers (including the Server Manager machine) into the Trusted Root Certification Authorities store – see the article on the certificate warning.
Renewing a certificate
When the server certificate expires, run the wizard again and select Use an existing root certificate (recommended) with your existing Root CA (file *_CA.pfx in the CA folder). The clients then keep their installed root certificate – no redistribution is required.
Note: Keep the root certificate's private key safe. You need it to renew expiring server certificates without having to create (and redistribute) a new root certificate.
CNG specifics: "Issuer certificate does not have a private key"
If you use an existing root certificate from an older PFX file (e.g. created with OpenSSL or exported from IIS), certificate creation may abort with the error message "Issuer certificate does not have a private key": Windows stores the private key of such files in a legacy CryptoAPI provider that the CNG-based signing in version 19 cannot access. Solutions:
Create a new root certificate with the wizard (simplest approach; redistribute the root certificate afterwards).
Have the certificate reissued or re-exported by your certification authority so that the private key resides in the CNG provider.
Convert the PFX file with the Windows tool
certutilto the "Microsoft Software Key Storage Provider" and then export it again as PFX.
Expiry behavior
If the configured certificate has expired, the server automatically falls back to its default certificate and records this in the system log (Tools → System Log). The Windows client (TCP connection) then shows the certificate warning again; the Web Client is blocked by the browser. You can see which certificate is active under Manage → Server Certificates; the Windows client also lets you view the server certificate's validity period. For orientation: the automatically created default certificate is valid for two years, the associated default Root CA for ten years.
Related topics: