I am trying to replace the self-signed certificate used while installing / configuring FAST server with a new certificate issues by my CA authority. I am following the tecnet article http://technet.microsoft.com/en-us/library/ff381244. I verified that the new CA certificate is installed in local and Trusted certificate store. However when I try to run the command:

.\ReplaceDefaultCertificate.ps1 -thumbprint "98 3c......"

I get the following error:

Error trying to check if FASTSearchAdministrators has access to certificate At D:\FASTSearch\installer\scripts\include\certificatesharedfunctions.ps1:597 char:13
+           throw <<<<  "Error trying to check if FASTSearchAdministrators has access to certificate"
    + CategoryInfo          : OperationStopped: (Error trying to... to certificate:String) [], RuntimeException
    + FullyQualifiedErrorId : Error trying to check if FASTSearchAdministrators has access to certificate

    Error trying to run one of 'netsh http add sslcert ipport= certhash=<given_thumbprintid> appid={a5455c78-6489-4e13-b395-47fbdee0e7e6}
    At D:\FASTSearch\installer\scripts\include\certificatesharedfunctions.ps1:432 char:13

I verified that the user with which I am running the command is a part of local administrators group. Also when I try to run the command

.\SecureFASTSearchConnector.ps1 -ssaName "FAST Content SSA" -username "mycompany.com\myserviceaccount"

I get the error

No valid certificate found to configure your SSA. Exiting.

When I try to run the command

Ping-SPEnterpriseSearchContentService –HostName "MYSERVER.MYDOMAIN.COM"

I got False for each entry. Any help would be appreciated.

2 Answers 2


I have never touched FAST server but from the point of common sense and having configured and used code signing certificates...

I do not see where is "a new certificate issues by my CA authority" can be used by "following the tecnet article http://technet.microsoft.com/en-us/library/ff381244 "

That article describes situations of:

  • replacing self-signed certificate by a 3d-party CA certificate
  • or by another self-signed certificate

but not by your own one.

In the latter case, IMO, besides or before installing your own certificate you should enable, configure and run your own AD Certificate Services with some pitfalls that I found useful to know in advance


Do you have UAC enabled? If so, maybe try running the powershell prompt as administrator.

  • My powershell command prompt is running as administrator only.
    – Ashish
    Jul 12, 2012 at 12:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.