Error while replacing self-signed certificate with CA certificate in FAST server

Question

I am trying to replace the self-signed certificate used while installing / configuring FAST server with a new certificate issues by my CA authority. I am following the tecnet article http://technet.microsoft.com/en-us/library/ff381244. I verified that the new CA certificate is installed in local and Trusted certificate store. However when I try to run the command:

.\ReplaceDefaultCertificate.ps1 -thumbprint "98 3c......"

I get the following error:

Error trying to check if FASTSearchAdministrators has access to certificate At D:\FASTSearch\installer\scripts\include\certificatesharedfunctions.ps1:597 char:13
+           throw <<<<  "Error trying to check if FASTSearchAdministrators has access to certificate"
    + CategoryInfo          : OperationStopped: (Error trying to... to certificate:String) [], RuntimeException
    + FullyQualifiedErrorId : Error trying to check if FASTSearchAdministrators has access to certificate

    Error trying to run one of 'netsh http add sslcert ipport=0.0.0.0:13258/13271/13391 certhash=<given_thumbprintid> appid={a5455c78-6489-4e13-b395-47fbdee0e7e6}
     clientcertnegotiation=enable'
    At D:\FASTSearch\installer\scripts\include\certificatesharedfunctions.ps1:432 char:13

I verified that the user with which I am running the command is a part of local administrators group. Also when I try to run the command

.\SecureFASTSearchConnector.ps1 -ssaName "FAST Content SSA" -username "mycompany.com\myserviceaccount"

I get the error

No valid certificate found to configure your SSA. Exiting.

When I try to run the command

Ping-SPEnterpriseSearchContentService –HostName "MYSERVER.MYDOMAIN.COM"

I got False for each entry. Any help would be appreciated.

Answer 1

I have never touched FAST server but from the point of common sense and having configured and used code signing certificates...

I do not see where is "a new certificate issues by my CA authority" can be used by "following the tecnet article http://technet.microsoft.com/en-us/library/ff381244 "

That article describes situations of:

• replacing self-signed certificate by a 3d-party CA certificate
• or by another self-signed certificate

but not by your own one.

In the latter case, IMO, besides or before installing your own certificate you should enable, configure and run your own AD Certificate Services with some pitfalls that I found useful to know in advance

Answer 2

Do you have UAC enabled? If so, maybe try running the powershell prompt as administrator.