How to migrate or reuse an SSL certificate in ADSelfService Plus
Objective
This article explains how to locate and migrate an existing SSL certificate from one ADSelfService Plus instance to another. This is useful when migrating your application to a new server, allowing you to reuse your current certificate, ensuring secure communication (HTTPS).
Prerequisites
- You must have administrative access to the ADSelfService Plus server's file system.
- You must have administrative privileges in ADSelfService Plus.
- The SSL certificate must be valid and not expired.
Steps to migrate an SSL certificate
Step 1: Locate the certificate file
- Once an SSL certificate is applied in ADSelfService Plus, it is stored in C:\Program Files\ManageEngine\ADSelfService Plus\conf\server.p12. The server.p12 file contains both the SSL certificate and the private key.
- Copy the file. The server.p12 file can then be imported into other web servers if required.
Step 2: Retrieve the keystore password
- In the same \conf folder, open the file server.xml with a text editor.
- Search for the attribute keystorePass. The value will be your password. Example: <... keystorePass="YourPassword123" ...>
Note: The password will be in plain text unless the Encrypt Keystore Password option has been enabled under Admin > Product Settings > Connection. If it is encrypted, you will need the plaintext password you originally set. You now have the server.p12 file and its password, which are required for the new server.
Step 3: Importing the certificate into the new server
- Paste the server.p12 file that you backed up from the old server in step one in the new server.
- Follow the steps listed in this article to apply your PFX/PKCS12 certificate on the new ADSelfService Plus server.
Tips
- Certificate common name: An SSL certificate is issued for a specific domain name (e.g., ssp.yourcompany.com) or a wild card entry (e.g.,*.yourcompany.com). If you migrate the certificate to a new server that will be accessed using a different URL, users will see a security warning. The certificate will only work without errors if the new server uses the same access URL as the old one.
- Renew expired certificates: If the SSL certificate is nearing expiration, renew it before migrating to avoid downtime.
- Exporting for other web servers: The server.p12 file is compatible with other servers that accept PKCS12/PFX formats, such as IIS. You can rename the file to server.pfx and use the same keystore password to import it into other web servers if needed.
Related topics and articles
How to reach support
New to ADSelfService Plus?
Related Articles
Migrating from ADSelfService Plus 32-bit to ADSelfService Plus 64-bit
This article will help you migrate from ADSelfService Plus 32-bit version to the 64-bit version. Before you begin 32-bit to 64-bit migration is possible only between the same builds. For example, you cannot migrate from a 32-bit version of build 5310 ...How to install P7B certificate in ADSelfService Plus?
Summary This article will guide you through the process of applying a single-domain certificate (CER, CRT, P7B, etc.) in ADSelfService Plus. Configuration steps Step 1: Enable HTTPS in ADSelfService Plus Log in to ADSelfService Plus with admin ...How to migrate the ADSelfService Plus installation from one machine to another
Description This article will guide you through the process for migrating the ADSelfService Plus installation from one machine to another. Important: Before you start the migration process, please update your ADSelfService Plus installation to the ...Encryption and data storage in ADSelfService Plus database
Encryption in the ADSelfService Plus database ADSelfService Plus' database uses the following encryption methods to store sensitive data: Database Encryption method PostgreSQL AES-256-CBC Microsoft SQL AES-256-CBC The following sensitive information ...How to configure mail server in ADSelfService Plus with TLS / SSL?
All communication between ADSelfService Plus and your mail server can be secured with either Transport Layer Security (TLS) or Secure Sockets Layer (SSL) protocol. Mail server requirements: TLS or SSL must be enabled in the mail server. The mail ...