How to change certificate used by Cayosoft Guardian

Cayosoft Guardian creates its own self-signed certificate during installation. This article describes how to change this default certificate to a custom one using netsh commands for HTTP.

How to change the certificate in Cayosoft Guardian web portal

1. Open the Cayosoft Guardian web portal.

2. Expand Settings node.

3. Click the Service Settings.

4. Select Network Settings.

5. Click Properties.

6. On the General tab, click the edit icon next to the SSL certificate label.

7. Select a certificate and click Select.

8. Go back to Service Settings and press Restart service.
   

How to change the certificate with PowerShell

1. Run an elevated PowerShell ISE or PowerShell command prompt.

2. Run the following command to check if the port 443 already has a bound certificate:

   Copy

   netsh http show sslcert

   If the command above returned a record with IP:port = 0.0.0.0:443, you need to delete the old certificate:

   Copy

   netsh http delete sslcert ipport=0.0.0.0:443

3. Bind the new certificate to 443 port:
   

   Copy

   netsh http add sslcert ipport=0.0.0.0:443 certhash="<certificate thumbprint>" appid="{<application guid>}"

4. Replace <certificate thumbprint> with your custom certificate thumbprint found in the properties of the certificate. Replace <application guid> with the GUID of the bound application. You can use the same GUID that was returned by the netsh http show sslcert command. Refer to the following example:

   Copy

   netsh http add sslcert ipport=0.0.0.0:443 certhash="831C11EF1D8886A0B3D0A598

Troubleshooting "A specified logon session does not exist. It may already have been terminated" issue

When changing the SSL certificate used by the Cayosoft Guardian, you may find that a certificate you uploaded appears in the Select SSL Certificates list, but selecting it returns the following error:

A specified logon session does not exist. It may already have been terminated.

Cause

This error indicates that the selected certificate does not have a usable private key on the Cayosoft Guardian server. When you select a certificate, Cayosoft Guardian binds it to the HTTPS endpoint, and that binding operation requires access to the certificate's private key.

The most common causes are:

• The certificate was exported or provided without its private key (for example, in .cer format instead of .pfx (PKCS#12)).
• The certificate was imported so that the private key is not accessible to the Local Machine account (for example, it was imported into the Current User store instead of Local Machine, or the private key permissions do not allow the Cayosoft Guardian service account to access it).

Solution

1. Re-export the certificate from your Certificate Authority, making sure to select Yes, export the private key, and save it in .pfx (PKCS#12) format.
2. Import the .pfx file into the Local Machine > Personal certificate store on the Guardian server (run certlm.msc).
3. In Cayoosft Guardian, navigate to Settings > Service Settings > Network Settings, and then select the certificate again.
4. Restart the Cayosoft Guardian service.

After the service restarts, the certificate binds successfully and the error no longer appears.