Use an existing IIS certificate

If your organization's intranet is served by Internet Information Server (Windows), Apache (Linux), or another web server, you might be able to use the IIS certificate for PaperCut NG/MF.

You can use an existing IIS certificate if either:

  • your intranet server and PaperCut NG/MF Application server run on the same server, that is, they have the same server name and address
  • you have a wild-card certificate that allows arbitrary subdomains under the domain name (for example, for which it was issued

Step 1: Export the existing certificate with key

To export your trusted certificate:

  1. Open the Windows management console.
  2. Select your IIS server.
  3. Navigate to the Windows Start menu.
  4. Right-click the Command Prompt.
  5. Select Run as administrator.
  6. Run the following command:
  7. Verify that the Console Root screen is displayed:

  8. On the Console Root screen, press the keyboard shortcut Ctrl+M.
  9. Verify that the Add or Remove Snap-ins screen is displayed:

  10. On the Add or Remove Snap-ins screen’s Available snap-ins list, select Certificates; click Add:

  11. From the Certificates snap-in screen, select Computer account; click Next>:

  12. Click Finish:

  13. Verify that on the Add or Remove Snap-ins screen’s Selected snap-ins list, Console Root > Certificates is displayed:

  14. Click OK.
  15. On the Console Root screen, navigate to: Console Root > Certificates > Personal > Certificates:

  16. Right click the certificate and navigate to: All Tasks > Export…:

  17. Follow the Certificate Export Wizard’s prompts:
    1. Click Next:

    2. Select Yes, export the private key; click Next:

    3. Select Personal Information Exchange, Include all certificates in the certification path if possible and Enable certificate privacy; click Next:

    4. Select Password; then enter the export password; then click Next.

      Important: When importing the certificate use this same password as the source keystore password.

    5. Click Browse:

    6. Select the directory in which the certificate will be exported to:

    7. Enter the File name that the certificate will be exported as, in the directory you selected; click Save:

    8. Verify that the File name displays the path of directory you selected and the file name of the certificate that you specified; click Next:

    9. Click Finish:

    10. Click OK:

  18. Close the Find Certificates screen.
  19. Close the Console Root screen.
  20. Click No:

Step 2: Import the certificate into the PaperCut NG/MF keystore

To import your trusted certificate into the PaperCut NG/MF keystore:

  1. Navigate to the directory where your exported certificate is saved and copy the certificate.
  2. Navigate to the following path on your PaperCut NG/MF Application ServerAn Application Server is the primary server program responsible for providing the PaperCut user interface, storing data, and providing services to users. PaperCut uses the Application Server to manage user and account information, manage printers, calculate print costs, provide a web browser interface to administrators and end users, and much more. and paste the certificate in this path:


  3. Right-click the Command Prompt.
  4. Select Run as administrator.
  5. Run the following command:


  6. On the directory, delete any existing files with the following name:


  7. On the Command Prompt, run the following command:

    keytool -importkeystore -srckeystore "[app-path]\server\custom\MySslExportCert.pfx" -srcstoretype pkcs12 -destkeystore "[app-path]\server\custom\my-ssl-keystore"

  8. Enter the following responses to the SSL keyIn typical public key infrastructure (PKI) arrangements, a digital signature from a certificate authority (CA) attests that a particular public key certificate is valid (i.e., contains correct information). An SSL key can be either a public key (can be disseminated publicly) or a private key (known only to the owner).:

    Enter destination keystore password: Enter keystore password.

    Re-enter new password: Re-enter the same keystore password.

    Enter source keystore password: Enter the same password as entered while exporting the certificate on the Certificate Export Password screen.

    For example:

    keytool -importkeystore -srckeystore "c:\Program Files\PaperCut NG/MF\server\custom\MySslExportCert.pfx" -srcstoretype pkcs12 -destkeystore "c:\Program Files\PaperCut NG/MF\server\custom\my-ssl-keystore"

Step 3: Configure the PaperCut NG/MF keystore


Changes are not applied until the PaperCut NG/MF Application Server is restarted.

To configure the PaperCut Application Server to use the new key/certificate:

  1. Copy your signed keystore onto the server running the PaperCut NG/MF Application Server. The suggested location is [app-path]/server/custom/my-ssl-keystore

  2. Open the file [app-path]/server/ with a text editor (e.g. Notepad).

  3. Locate the section titled SSLSecure Sockets Layer (SSL) is the standard security technology for establishing an encrypted link between a web server and a browser. This link ensures that all data passed between the web server and browsers remain private and integral. The protocol uses a third party, a Certificate Authority (CA), to identify one end or both end of the transactions. To be able to create an SSL connection a web server requires an SSL certificate. When you choose to activate SSL on your web server you will be prompted to complete a number of questions about the identity of your website and your company. Your web server then creates two cryptographic keys - a Private Key and a Public Key. Key/Certificate.

  4. Remove the # (hash) comment marker from all lines starting with "server.ssl".

  5. Define the following: value Description
    server.ssl.keystore=custom/my-ssl-keystore The location of your keystore. This must match the value specified by -k in create-ssl-keystore. If you did not specify this value in create-ssl-keystore, leave it as default.
    server.ssl.keystore-password=default The keystore password. This must match the value specified by -keystorepass in create-ssl-keystore. If you did not specify this value in create-ssl-keystore, leave it as default.
    server.ssl.key-password=default The keystore key password. This must match the value specified by -keystorekeypass in create-ssl-keystore. If you did not specify this value in create-ssl-keystore, leave it as default.

    NOTE: On Mac OS, for server.ssl.keystore, specify the FULL path to your keystore, e.g. /Applications/PaperCut NG/MF/server/custom/my-ssl-keystore

  6. Save the file.
  7. Restart the PaperCut NG/MF Application Server and verify all is working. If the server fails to start, error messages are recorded in logs located in the server's logs directory.


Share your findings and experience with other PaperCut users. Feel free to add comments and suggestions about this Knowledge Base article. Please don't use this for support requests.