Body
How to Install or Renew an SSL Certificate on a Claris FileMaker Server
Audience
Intended Audience: Windows server administrators and application owners responsible for installing and renewing SSL certificates on Claris FileMaker Server instances.
Overview
This guide describes the procedure for installing or renewing an SSL certificate on a Claris FileMaker Server. The CSR is generated by FileMaker Server itself, the certificate is issued through InCommon, and KeyStore Explorer is used to convert the InCommon downloads into the three files FileMaker requires for import: a signed certificate PEM, a private key PEM, and a concatenated chain PEM.
Important: Private Key Handling
Do not overwrite or delete the existing private key before a replacement certificate is confirmed working. The private key is cryptographically paired with the current certificate — if the key is overwritten and the new certificate import fails, the server cannot complete a TLS handshake and there is no rollback path.
FileMaker Server stores the relevant files in:
Path:
C:\Program Files\FileMaker\FileMaker Server\CStore\
The files of interest are:
- serverKey.pem — the private key
- serverRequest.pem — the CSR submitted to the CA
- serverCustom.pem — the signed certificate once installed
The private key never leaves the server. When submitting the CSR to the CA (InCommon / Sectigo via Pitt), send only the contents of serverRequest.pem. The serverKey.pem file must remain on the FileMaker Server — this is the entire point of the CSR exchange.
Prerequisites
You will need:
- Administrative access to the FileMaker Server (RDP and Windows local admin)
- FileMaker Server admin credentials (stored in the team password manager)
- Browser access to the FileMaker Admin Console at https://[SERVER_FQDN]:16000/admin-console
- Access to the InCommon certificate portal to submit CSRs and download issued certificates
- All FQDNs that will be covered by the certificate (for SAN certificates)
- KeyStore Explorer (https://keystore-explorer.org/) installed on a workstation
Step 1: Open the FileMaker Admin Console
Navigate to the Admin Console in a browser and log in as the FileMaker administrator.
URL:
https://[SERVER_FQDN]:16000/admin-console
The admin password is stored in the team password manager.
Step 2: Generate the CSR
On the Configuration tab, click SSL Certificate, then click Create CSR. Complete the fields for the certificate subject.
When prompted, set a private key password. Record this password in the team password manager — it will be required during import and cannot be recovered later.
FileMaker Server will create the following files in the CStore folder:
- serverRequest.pem — the CSR to submit to InCommon
- serverkey.pem — the new private key
Step 3: Submit the CSR to InCommon
Copy the contents of serverRequest.pem and submit it through the InCommon certificate portal as a new or renewal request, selecting the appropriate certificate profile (for example, SAN or Single Domain).
Step 4: Download the Issued Certificate Files
When the certificate is issued, the InCommon enrollment email contains multiple download formats. Download both of the following:
- X509, Base64 encoded — the server certificate
- X509 Root/Intermediate(s) only, Base64 encoded — the chain
Save them to a working folder on a workstation that has KeyStore Explorer installed.
Step 5: Export the Server Certificate as PEM
Open KeyStore Explorer and choose Examine a Certificate. Examine the [server_fqdn].crt file from the X509 Base64 encoded download.
- Select the cert at the bottom of the hierarchy and click the PEM button.
- Click Export and save the file as [server_fqdn].pem.
- Click OK to close the export dialog, then OK again to close the PEM view.
Step 6: Export Each Certificate in the Chain
In KeyStore Explorer, examine the [server_fqdn]_interm.cer file from the X509 Root/Intermediate(s) Base64 encoded download. The chain contains three certificates. For each one:
- Top of hierarchy: select the certificate, click PEM, click Export, save as [server_fqdn]_root.pem, click OK.
- Second from top: select the certificate, click PEM, click Export, save as [server_fqdn]_root2.pem, click OK.
- Bottom of hierarchy: select the certificate, click PEM, click Export, save as [server_fqdn]_intermediate.pem, click OK.
Click OK to close the PEM view.
Step 7: Assemble the Chain File
Open a text editor and create a new file. Paste the contents of the three exported PEM files in order, with no blank lines between them:
- Contents of [server_fqdn]_root.pem
- Contents of [server_fqdn]_root2.pem (immediately after, no blank line)
- Contents of [server_fqdn]_intermediate.pem (immediately after, no blank line)
Save the combined file as chain.pem.
Step 8: Export the Private Key as PEM
In KeyStore Explorer, examine the serverkey.pem file generated by FileMaker Server in Step 2.
- When prompted for the password, enter the private key password set when the CSR was generated (stored in the team password manager).
- Click the PEM button.
- Click Export and save the file as privatekey.pem.
- Click OK to close the export dialog, then OK again to close the PEM view.
Quit KeyStore Explorer before continuing.
Step 9: Archive the Existing Certificate and Key
RDP into the FileMaker Server and open the CStore folder.
Path:
C:\Program Files\FileMaker\FileMaker Server\CStore\
Create a new folder (for example, an archive folder with a datestamped name) and move the existing serverCustom.pem and serverKey.pem files into it.
This must be done before clicking Import in the next step. Do not delete the files — this folder is the rollback path if the new certificate fails to import or activate.
Step 10: Import the Certificate
In the Admin Console, on the Configuration tab, click SSL Certificate, then click Import Custom Certificate. In the import dialog, select each of the three files prepared in Steps 5 through 8:
- Signed Certificate File: [server_fqdn].pem
- Private Key File: privatekey.pem
- Intermediate Certificate File: chain.pem
In the Private Key Password field, enter the password set when the CSR was generated (stored in the team password manager).
Click the Import button. The certificates should import successfully. Log out of the FileMaker Server Admin Console.
Step 11: Restart the FileMaker Server Service
On the server (RDP session), open Computer Management, then navigate to Services and Applications → Services. Locate the FileMaker Server service, select it, and click the button to restart the service.
Step 12: Verify the Installed Certificate
Refresh the FileMaker Server Admin Console in a browser. Log in with the FileMaker Server admin account, click the Configuration tab, then SSL Certificate, and examine the SSL certificate information. Confirm the subject, SANs, issuer, and expiration date match the newly issued certificate.
Then use the browser’s certificate viewer (lock icon → certificate details) to confirm the chain is complete and trusted, and that the issuer is InCommon.
Step 13: Clean Up the Archive
Once the new certificate is confirmed working through Step 12, the archive folder containing the old serverCustom.pem and serverKey.pem files may be deleted. Do not delete it before verification — it is the rollback path.
Common Issues
- Overwriting the existing private key before a replacement certificate is verified leaves the server with no rollback path
- Importing the server certificate without a correctly assembled chain.pem produces trust warnings in browsers
- Assembling chain.pem with blank lines between the certificate blocks can cause the chain to fail validation — the blocks must be contiguous
- Not restarting the FileMaker Server service after import leaves the old certificate active
- Submitting the wrong file to the CA — for example, sending serverkey.pem instead of serverRequest.pem — exposes the private key and requires re-issuance
- Losing the private key password set during CSR creation will block the import; the password is not recoverable from FileMaker
Conclusion
Installing or renewing an SSL certificate on Claris FileMaker Server requires generating a CSR in FileMaker, processing the InCommon-issued certificates through KeyStore Explorer to produce a signed certificate PEM and a concatenated chain PEM, archiving the existing key and certificate, and importing the new files through the Admin Console. The existing private key must be archived — not overwritten — until the new certificate is confirmed working in the browser.
Feedback and Concerns
Our articles are continuously improving, and your feedback helps us make them even better. If you have any comments or suggestions about this article, please email hsitkb@pitt.edu or use the "Was this helpful?" section below to leave a response.