MailStore Error ‘The certificate with identifier used to sign the client assertion is expired on application. Reason – The key used is expired’
This warning has happened because the certificate you created when synchronising MailStore with your Microsoft Entra ID has now expired.
To resolve this issue you will need to create a new one within MailStore and upload to your App registration within Microsoft Entra ID
To resolve this issue you will need to create a new one within MailStore and upload to your App registration within Microsoft Entra ID
The following guide will take you through these steps.
Creating a new Certificate within MailStore Server
- Log on to MailStore Client as a MailStore Server administrator
- Click on Administrative Tools > Users and Archives > Directory Services
- In the Connection section, click on the button (…) next to the Credentials drop-down list
- In the Credential Manager that appears, select the current credentials configured (most likely called ‘MailStore Server’) and click on edit
- In the Microsoft Entra ID App Credentials dialog, click on the small down arrow on the Certificate line and choose ‘Create certificate
- Once created again click on the same down arrow and select Download Certificate. Save the certificate on your hard drive.
- Confirm your entries by clicking OK.
Publishing Credentials in Microsoft Entra ID
- In the navigation menu (☰), select the option Microsoft Entra ID
- On the next page, select App registrations in the Manage section of the left navigation menu
- Select All Applications. And select the ‘MailStore’ Application you previously configured
- Select Certificates & secrets in the Manage section of the left navigation menu
- You should see your previous expired certificate here. which you can delete once you have uploaded the new certificate
- Click on Upload certificate in the Certificates section. Select the certificate file that you have saved previously and upload it to Microsoft Entra ID by clicking Add
- If uploading has been successful, the certificate's thumbprint as well as its start and expiry dates appear in the certificates list. You can compare the thumbprint and expiry date with those listed in the MailStore Credential Manager to check that you've uploaded the correct certificate
Related Articles
Adding a new Modern Authentication Application certificate when the existing one is due to expire
During the configuration of Modern Authentication, a required step is to create an Application Certificate within the credential manager in MailStore, and upload it to the Azure Portal. This certificate typically only lasts for 15 Months and ...How to reset the Microsoft Service Principle if it has expired (Basic Authentication)
When using MailStore to archive Microsoft Office365 and using the basic authentication one important step is to create a Service Principle account using the Microsoft Azure PowerShell interface. By default, this Service Principle account id is only ...ERROR: ‘This XML file does not appear to have any style information associated with it’
When users attempt to login to MailStore Using Microsoft login credentials, after authenticating directly with Microsoft they are redirected to a Mailstore URL and receive the following error: ‘This XML file does not appear to have any style ...How to reset MailStore Client login credentials if they are saved but incorrect
Administrators often use the MailStore Client option to "Always connect to this server" to make the login on the server quicker as subsequent logins will just go straight to the user login stage. This works well but if the Server Name stored is no ...Moving a MailStore server installation to a new server
To move a MailStore Server archive to a new machine including all users, settings and emails follow these steps: Stop the MailStore Server service on the current machine, either through the MailStore Server Service Configuration tool or the service ...