Manual ADCS SSL Certificate Setup for ManageEngine Password Manager Pro

In many enterprise environments, certificate issuance is handled through Microsoft ADCS rather than public certificate authorities. That works well for internal applications, but Java-based platforms such as ManageEngine Password Manager Pro require a few extra steps because the certificate must be placed into a keystore format PMP can use.

This article focuses on the manual certificate workflow: requesting the certificate through the Windows certificate console, exporting it with the private key, converting it with keytool, and updating the PMP service configuration.

When This Method Makes Sense

Use this approach when Web Enrollment is not available, when certificate requests are handled directly from Windows MMC, or when the environment requires administrators to manually control certificate export and keystore placement.

Prerequisites

• Active Directory Certificate Services is already deployed.
• A Web Server certificate template is available for enrollment.
• You have administrative access to the Password Manager Pro server.
• The Java keytool utility is available.
• DNS is configured for the Password Manager Pro hostname.

Recommended Certificate Values

Before requesting the certificate, confirm the fully qualified DNS name users will use to access PMP. The certificate should match that name exactly.

Certificate Field	Example Value
Common Name	pmp.yourdomain.com
DNS SAN	pmp.yourdomain.com
Additional DNS SAN	pmp

Step 1: Request the Certificate from MMC

On the PMP server, or on another Windows server that can enroll against ADCS, open certlm.msc. Navigate to Personal → Certificates, then right-click Certificates and choose All Tasks → Request New Certificate.

Select the Web Server certificate template. If Windows reports that more information is required, open the certificate details link and configure the subject and SAN values before submitting the request.

Step 2: Export the Certificate as a PFX

After the certificate is issued, return to certlm.msc and locate the new certificate under Personal → Certificates. Right-click the certificate and choose All Tasks → Export.

• Choose Yes, export the private key.
• Select the PFX format.
• Set a strong export password.
• Save the file as pmp_cert.pfx.

Step 3: Convert the PFX to a Java Keystore

Password Manager Pro runs on Java/Tomcat, so the certificate usually needs to be converted into a JKS or PKCS12 keystore before PMP can use it.

keytool -importkeystore
  -srckeystore pmp_cert.pfx
  -srcstoretype PKCS12
  -destkeystore pmp_keystore.jks
  -deststoretype JKS

Use a secure keystore password and save it carefully. You will need the same password when updating the PMP HTTPS connector.

Step 4: Replace the PMP Keystore

Stop the Password Manager Pro service before replacing the keystore. Then go to the PMP installation directory and open the conf folder.

• Back up the existing server.keystore file.
• Rename the new JKS file to server.keystore.
• Place the renamed keystore into the PMP conf directory.

Step 5: Update server.xml

Edit the following file:

<PMP Install Directory>\conf\server.xml

Find the HTTPS connector section and update keystorePass so it matches the password used for the Java keystore.

<Connector port="7272"
  SSLEnabled="true"
  keystoreFile="conf/server.keystore"
  keystorePass="yourpassword"
  sslProtocol="TLS"/>

Step 6: Import the CA Chain

If your environment uses a root CA and one or more intermediate CAs, import the CA chain into the keystore as needed. This helps PMP present a complete and trusted certificate path.

keytool -import -trustcacerts
  -alias rootCA
  -file rootCA.cer
  -keystore server.keystore

Step 7: Start PMP and Validate HTTPS

Start the Password Manager Pro service and browse to the PMP URL:

https://pmp.yourdomain.com:7272

Confirm that the browser trusts the certificate, the hostname matches, and the certificate chain is complete.

Alternative: Use certreq Instead of MMC

For automation or environments where GUI enrollment is restricted, the request can also be generated with certreq.

[Version]
Signature="$Windows NT$"

[NewRequest]
Subject = "CN=pmp.yourdomain.com"
KeyLength = 2048
Exportable = TRUE
MachineKeySet = TRUE
RequestType = PKCS10

[Extensions]
2.5.29.17 = "{text}"
_continue_ = "dns=pmp.yourdomain.com&"
_continue_ = "dns=pmp"

[RequestAttributes]
CertificateTemplate = WebServer

Generate, submit, and accept the request with:

certreq -new pmp.inf pmp.req
certreq -submit pmp.req pmp.cer
certreq -accept pmp.cer

Common Issues to Check

• Missing SAN entries causing browser certificate errors.
• The private key was not exported with the certificate.
• The keystore password in server.xml does not match the actual keystore password.
• The root or intermediate CA certificates are not trusted.
• The DNS hostname does not match the certificate CN or SAN values.

Best Practice: Consider Reverse Proxy SSL Termination

For easier long-term certificate management, many enterprises place Password Manager Pro behind an IIS or nginx reverse proxy. In that model, SSL is terminated at the reverse proxy using the organization’s standard Windows certificate workflow, reducing the need to manage Java keystores directly inside PMP.