You are here: Administration > Tools - database, server-command scripting, and APIs (Advanced) > Generate an SSL/HTTPS key > Customize the PaperCut NG self-signed certificate

Customize the PaperCut NG self-signed certificate

During the install process, PaperCut NG generates a self-signed key/certificate issued for the host's machine name. This key is used by default when the system is accessed via HTTPS on port 9192.

The default SSL certificateSSL certificates are small data files that digitally bind a cryptographic key to an organization’s details, such as a company's domain name, your company name, your address, your city, your state and your country. When installed on a web server, it activates the padlock and the HTTPS protocol (over port 443) and allows secure connections from a web server to a browser. When a browser connects to a secure site it retrieves the site's SSL certificate and checks that it has not expired, it has been issued by a Certification Authority the browser trusts, and that it is being used by the website for which it has been issued. If it fails on any one of these checks the browser will display a warning to the end user letting them know that the site is not secured by SSL. SSL certificates can be either self-signed or CA signed. provides good security, however, users will be presented with the “Domain mismatch warning” when they access the HTTPS site using a fully-qualified domain. This section describes how to customize the self-signed key/certificate so that the “Domain mismatch warning” is not displayed.


The “Certificate has not been signed by a trusted authority” warning will still be displayed. To avoid that message, you need use a certificate signed by a trusted authority. For more information see Use a certificate signed by a trusted authority.


  1. Use the tool create-ssl-keystore to recreate the key/certificate (stored in a keystore file) for a different hostname, eliminating the browser domain mismatch warning. An example of the command's use:

    cd [app-path]/server/bin/win

    create-ssl-keystore -f ""

    More information is available via the --help command line option.

    Usage: create-ssl-keystore [-f] [-k FILE] [SYSTEM_NAME]

    -f Force: Overwrite any existing keystore file.

    -k FILE: Define a keystore file location. If not set the keystore is created in the default location (server/data/default-ssl-keystore).

    SYSTEM_NAME: The name of the computer/server used to generate keystore. If not defined, the current computer name is used.


    If you use the -k option, you also need to:

  2. Restart the Application Server.

For backwards compatibility with 3rd party systems the default self-signed certificate is generated with a SHA1 algorithm. See Can I use other algorithms such as SHA2/SHA256?


Share your findings and experience with other PaperCut users. Feel free to add comments and suggestions about this Knowledge Base article. Please don't use this for support requests.