Updating a SharePoint CA certificate chain

Update the SharePoint CA certificate chain when certificates expire or security requirements change. Coordinate these updates with active file scanning to prevent service interruptions.

Note

Updating a certificate chain requires more coordination than initial configuration.

Prerequisites

Operator or Admin access.
A validated certificate chain file.
Identified storage shares and active scans.

Prepare for the update

Verify the current state of shares and scans before you update the chain.

Identify storage configurations using the certificate chain:
```
hostname (config)# show fmps storage name <storage_name>
```
Review the CA file field for each Secure WebDAV share.
Identify all shares that use the certificate chain.

Document all active scans associated with these shares:

hostname (config)# show fmps file shares <share_name> scan-id

Record the scan IDs, names, and current status.
Record scan details to establish a verification baseline.

Update the certificate chain using the Web UI

Use the WebDAV CA Configuration section to update the chain.

Caution

You must stop scans and unmount storage. Pausing scans is not sufficient for certificate updates.

Click the Scans tab and select Configured and recent Scans.
For each scan using the affected storage, click Abort.
Make sure to pause addition of new files to the share and then abort the scan on File Protect, and all files on the share
Wait for the status to change to Aborted.
Click the Storage tab and select View Storage.
For each storage using the certificate chain, unmount CLI using fmps storage unmount <share_name>
Unmount cannot be done from the Web UI.
Confirm the storage status shows Unmounted.
Click the Settings tab and select Certificates/Keys.
In the WebDAV CA Configuration section, delete the existing chain.
Import the new certificate chain. Use the same name to avoid storage reconfiguration.
Verify that the new certificate is added to the share. Select Edit on the share and see Select Certificate.
If the certificate as a new name, verify the name otherwise check in the CLI.
Remount the storage and restart the scans.

Update the certificate chain using the CLI

Use these commands to stop scans and replace the certificate chain.

Identify and stop scans: Make sure to pause the addition of new files to the share.
1. Verify if there are any running submission of the share. If yes, then wait for it end or pause it.
```
hostname (config)# sh submission running
```
2. Abort the scan.
```
hostname (config)# fmps scan abort <scan-id>
```
3. Verify that the scan is aborted.
```
hostname (config)# sh fmps scan-id <scan-id>
```

Unmount storage:

hostname (config)# fmps storage unmount <share_name>

Delete the old chain:

hostname (config)# no crypto certificate sharepoint ca-chain chain-name <chainName>

Configure the new chain:

hostname (config)# crypto certificate sharepoint ca-chain chain-name <chainName> pem-bundle "<pemChainString>"

Save the configuration:
```
hostname (config)# write memory
```

Verify the chain details:

hostname # show crypto certificate ca-chain <chainName> detail

Verify the update

Confirm all components function correctly after the update.

Locate the storage mount and verify the status:

hostname (config)# fmps storage mount <share_name>
hostname (config)# show fmps storage name <storageName>

Confirm the status shows Share is mounted.

Restart the scans and verify that scans are running:

hostname (config)# fmps scan restart <scan_id>
hostname (config)# show fmps file shares <share_name> scan-id

Confirm the status shows Running or Continuous.
Monitor scan details for 10 minutes to ensure file counts increase:
```
hostname (config)# show fmps scan-id <id> details
```

Check logs for certificate validation or connectivity errors:

hostname (config)# show log matching WebDAV davfs certificates

Troubleshooting certificate updates

Storage shows "Share is mounted" but no files are being scanned

Cause: Scans may not have been properly restarted after the certificate update.

Resolution: Verify scan status with show fmps file shares <share_name> scan-id. If no scans are running, recreate the scan configurations that were aborted during the update process.

Certificate validation errors after update

Cause: The new certificate chain may be incomplete or incorrectly formatted.

Resolution: Verify the certificate chain includes all required certificates in the correct order: root CA, intermediate CAs, and endpoint certificate.

Storage fails to remount after certificate update

Cause: The new certificate may not be trusted by the WebDAV server, or the certificate chain is incomplete.

Resolution: Verify the certificate chain is complete using show crypto certificate ca-chain <chainName> detail. Test certificate validation with the SharePoint server.

Manual replacement method

Use the manual replacement method to provide a safer rollback path. This method creates a temporary parallel configuration.

Create a certificate chain using a new unique name.
Configure a new storage entry using this certificate chain.
Verify that the new storage mounts correctly.
Update scan configurations to point to the new storage.
Delete the old storage configuration and certificate chain after verification.

Best practices for certificate maintenance

Follow these practices to minimize service disruption:

Schedule updates during low-activity maintenance windows.
Always Abort scans and unmount storage during updates.
Document scan configurations before starting maintenance.
Replace certificates 30–60 days before expiration.
Test new chains in a non-production environment first.
Monitor scan activity for 24 hours after an update.

Caution

A mounted status does not guarantee active scanning. Always verify file processing activity.