Installing a separate security certificate from a trusted source

How to replace a self-signed certificate with one obtained from a trusted source.

20. April 2026

Table of Contents

Installing and using another certificate from a trusted source

When accessing the Operations Center Status app on a secure connection with a self-signed certificate (by typing https://servername:7001 in your web browser's address field), your browser will display a warning that the certificate is not trusted. That's because it is self-signed and not issued by a trusted certificate provider. However, you can safely proceed to configure the Operations Center Status, knowing that all traffic is transferred on a secure connection.

If you want to use a site certificate from a trusted source, you can purchase one from a trusted supplier.

After your certificate has been delivered, it is typically stored on your computer. You then have to bind the certificate to port 7001 on your server. But if Fotoware has already created a self-signed certificate and bound it to port 7001, you need to unbind that certificate from the port, and then bind the new, purchased, trusted certificate to port 7001.

The procedure for doing this is described below.

Checking if a self-signed certificate is tied to port 7001

Note

Before proceeding, stop the Operations Center service on the server.

Open the command prompt on your server. (Start | Run cmd) Then proceed as outlined below:

`1`	`netsh http show sslcert`

This lists any SSL certificate bindings. If you find an entry named IP:Port 0.0.0.0:7001, that means a certificate (most likely the Fotoware self-signed one) is bound to port 7001. You must delete this binding before you can bind your purchased, trusted certificate to port 7001.

Tip

If no bindings are listed, proceed to Binding your trusted certificate to port 7001.

Deleting the self-signed certificate's binding to port 7001

In the terminal, enter the following to delete the certificate's binding to port 7001:

`1`	`netsh http delete sslcert ipport=0.0.0.0:7001`

Binding your trusted certificate to port 7001

Before you can bind your new certificate to the port, you need to locate its thumbprint in the Microsoft Management Console.

Open the Start menu, click Run, then type MMC.
Open the File menu and choose Add/Remove Snap-in:
Select Certificates and select Add.
Select Computer Account and select Next.
Choose Local computer (assuming the signed certificate is stored on the local computer), then select Finish.
Select OK to close the Snap-In manager.
Expand the Certificates (Local Computer) node, then the Personal node, and then select the Certificates node:
Double-click the signed certificate to open its properties, then select the Details tab.
Scroll down to the Thumbprint property and copy the thumbprint hash to the clipboard. In the next step, you will need this thumbprint to create a port binding, but you will have to remove the spaces between the values. We recommend pasting the string into Notepad, for example, to remove the spaces.
Open the Command Prompt and type the following command:

`1`	`netsh http add sslcert ipport=0.0.0.0:7001 certhash=988377c7c92ea29eebfe0c78fd349cee9a41e18aa appid={00112233-4455-6677-8899-AABBCCDDEEFF}`

Replace the certhash variable with the thumbprint of the certificate you are installing. If you have not already done so, remember to remove the spaces between the thumbprint's values. The appid parameter is a GUID (Globally Unique Identifier) that identifies the owning application. You will have to generate a GUID for your application - there are many utilities available on the web that will let you do this - for example, http://www.guidgenerator.com/

Now that the certificate binding has been configured, you may want to require clients to connect securely to the server using SSL.

For more information about SSL port bindings, see: How to: Configure a Port with an SSL Certificate.