Keeping your server secure is a top priority, and a valid SSL certificate is a key part of that. In this guide, we’ll walk you through installing a new or renewed SSL certificate on your PaperCut MF server running macOS. We’ll use OpenSSL to convert your certificate files into a PFX file, import it into a Java keystore, and then configure PaperCut to use it.

Before you begin

• Terminal access with administrative privileges on your macOS server.
• OpenSSL installed on your server.
• Your SSL certificate files from your certificate provider. You need the following:
  • certificate.crt: your server certificate
  • private.key: the private key used to generate your certificate request
  • ca_bundle.crt: the intermediate/CA bundle (sometimes called a chain file)

Note: File names vary between providers. Check your provider’s documentation if your files are named differently.

Step 1: Prepare your certificate files

1. Create a folder on your desktop named CertRenew.
2. Copy your three certificate files (certificate.crt, private.key, and ca_bundle.crt) into this folder.

Step 2: Create a PFX file

A PFX file packages your private key and certificate chain into a single password-protected file that PaperCut can use.

1. Open Terminal from your Applications > Utilities folder.

2. Navigate to your certificate folder:

   cd ~/Desktop/CertRenew
   

3. Run the following command to create the PFX file:

   openssl pkcs12 -export -out certificate.pfx -inkey private.key -in certificate.crt -certfile ca_bundle.crt
   

4. Type a strong password when prompted. You will need this password in the next step.

Step 3: Import the PFX into PaperCut

PaperCut uses a Java utility called keytool to manage certificates. This step imports your PFX into a Java keystore.

1. In Terminal, navigate to the PaperCut JRE directory:

   cd "/Applications/PaperCut MF/runtime/mac/jre/Contents/Home/bin"
   

2. Run the import command:

   sudo ./keytool -importkeystore -srckeystore ~/Desktop/CertRenew/certificate.pfx -srcstoretype pkcs12 -destkeystore "/Applications/PaperCut MF/server/custom/my-ssl-keystore" -deststoretype JKS
   

3. When prompted, type a new password for the destination keystore.

4. When prompted, type the PFX password you created in Step 2.

Step 4: Configure PaperCut

Tell PaperCut where to find your new keystore file by editing the server properties.

1. Open the server properties file:

   sudo nano "/Applications/PaperCut MF/server/server.properties"
   

2. Find the server.ssl section in the file.

3. Remove the # from the start of the keystore lines.

4. Update the lines to match this configuration:

   server.ssl.keystore=/Applications/PaperCut MF/server/custom/my-ssl-keystore
   server.ssl.keystore-password=[Your Destination Password]
   server.ssl.key-password=[Your PFX Password]
   

5. Press Ctrl+O, press Enter, and press Ctrl+X to save.

Step 5: Restart PaperCut and verify everything works.

1. Stop the server:

   sudo "/Applications/PaperCut MF/server/bin/macosx/stop-server"
   

2. Start the server:

   sudo "/Applications/PaperCut MF/server/bin/macosx/start-server"
   

3. Open a browser and navigate to your admin console.

4. Click the padlock icon to verify the certificate details.

Related articles

• PaperCut MF - SSL Certificates (Windows) - The same process for Windows servers.
• Installing an SSL Certificate the Easy Way (Keystore Explorer) - A GUI-based alternative using KeyStore Explorer.
• Renewing Your SSL Certificate on macOS with Let’s Encrypt - Free certificates via Let’s Encrypt on macOS.