SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to replace the self-signed certificate used while installing / configuring FAST server with a new certificate issues by my CA authority. I am following the tecnet article I verified that the new CA certificate is installed in local and Trusted certificate store. However when I try to run the command:

.\ReplaceDefaultCertificate.ps1 -thumbprint "98 3c......"

I get the following error:

Error trying to check if FASTSearchAdministrators has access to certificate At D:\FASTSearch\installer\scripts\include\certificatesharedfunctions.ps1:597 char:13
+           throw <<<<  "Error trying to check if FASTSearchAdministrators has access to certificate"
    + CategoryInfo          : OperationStopped: (Error trying to... to certificate:String) [], RuntimeException
    + FullyQualifiedErrorId : Error trying to check if FASTSearchAdministrators has access to certificate

    Error trying to run one of 'netsh http add sslcert ipport= certhash=<given_thumbprintid> appid={a5455c78-6489-4e13-b395-47fbdee0e7e6}
    At D:\FASTSearch\installer\scripts\include\certificatesharedfunctions.ps1:432 char:13

I verified that the user with which I am running the command is a part of local administrators group. Also when I try to run the command

.\SecureFASTSearchConnector.ps1 -ssaName "FAST Content SSA" -username "\myserviceaccount"

I get the error

No valid certificate found to configure your SSA. Exiting.

When I try to run the command

Ping-SPEnterpriseSearchContentService –HostName "MYSERVER.MYDOMAIN.COM"

I got False for each entry. Any help would be appreciated.

share|improve this question

I have never touched FAST server but from the point of common sense and having configured and used code signing certificates...

I do not see where is "a new certificate issues by my CA authority" can be used by "following the tecnet article "

That article describes situations of:

  • replacing self-signed certificate by a 3d-party CA certificate
  • or by another self-signed certificate

but not by your own one.

In the latter case, IMO, besides or before installing your own certificate you should enable, configure and run your own AD Certificate Services with some pitfalls that I found useful to know in advance

share|improve this answer

Do you have UAC enabled? If so, maybe try running the powershell prompt as administrator.

share|improve this answer
My powershell command prompt is running as administrator only. – Ashish Jul 12 '12 at 12:31

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.