SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Using the FAST Content API with Sharepoint 2010 requires a SSL client certificate . At least that's what I understand from this error message"

Http error: HTTP/1.1 403 Could not verify client certificate.

I can configure my client to use a SSL certificate, but how do I import that into FAST? Since the content API ports are not handled by IIS, I can only assume that this is a FAST-specific configuration procedure.

Update: I've made the following steps:

  1. Generated a public+private key pair with the Java keytool application
  2. I've converted that keystore to to a PCKS12 (PFX) keystore which can be imported by Windows
  3. I've tried to import the keystore using the instructions for setting up SSL between FAST and Sharepoint, but I get a cryptic error

I can't make heads or tails of this but I can confirm that the certificate is installed alongside the FastSearchCert certificate in the Certificates (Local Computer) -> Personal -> Certificates Snap-In.

Note that the FAST machine is part of an AD, while the machine which generated the certificate is not.

PS C:\FASTSearch\Installer\scripts> .\securefastsearchconnector.ps1 -certPath c:\windows\temp\java-client-cert.pfx -ssaName FASTContent -username "CORP\Administrator"
Enter the certificate password: ******** 
Installed certificate.
Could not set access rights on certificates private keys. Script can be rerun to only set access rights when reason for error is detected.
Get-Acl : Cannot find path 'C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\6c8c8677fca4d588e808522374fc60aa_6c6a2f58-dc6a-42a6-80ac-19d3b57cafb5' because it does not exist.
At C:\FASTSearch\Installer\scripts\securefastsearchconnector.ps1:157 char:17
+         $acl = Get-Acl <<<<  $keypath$keyname
    + CategoryInfo          : ObjectNotFound: (:) [Get-Acl], ItemNotFoundException
    + FullyQualifiedErrorId : GetAcl_PathNotFound_Exception,Microsoft.PowerShell.Commands.GetAclCommand
share|improve this question

You can skip ssl verification in content api by using this code:

ServicePointManager.ServerCertificateValidationCallback += (sender, certifcate, chain, sslPolicyErrors) => true;  

Insert it before using api calls.

share|improve this answer
if I understand correctly ( I'm using Java in my client calls ) this allows the client to not validate the Server's certificate. But in my case the server requires that the client present a SSL certificate. – Robert Munteanu Jun 18 '12 at 14:41
To understand you correctly, you are using Java to pass content on to FAST, not the .NET content api? – Mikael Svenson Jun 18 '12 at 19:07
@Mikael-SharePointMVP - that's correct – Robert Munteanu Jun 18 '12 at 19:30
Thinking about it, java should work as the database connector uses it. If you follow the sample for .NET, it adds the thumbprint of the cert used when setting up https and passes this to the factory method of CreateDocumentFeeder. See C:\Program Files\Content API for Microsoft FAST Search Server 2010 for SharePoint\v1.0.15\examples\ContentAPIExample\ContentAPIExample.cs and the App.config file. Does that help, or have you already looked at it? – Mikael Svenson Jun 19 '12 at 8:40
@Mikael-SharePointMVP - I've seen those examples ; Java is not that well integrated with the Windows keystore ,so a thumbprint is not enough . I've managed to make it work by exporting the Java application's keystore as a PFX ( PKCS12 ) file and importing it into the server keystore of the server running FAST. I'll post this as an answer when I have the process documented. – Robert Munteanu Jun 20 '12 at 7:45

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.