Edit the GetSSL.ps1 file
The script file needs to be edited so that it know the address you wish to get an SSL certificate for as well as some paths on your system. Right-click on the ps1 file and select edit to open a text editor. Change the certificate domain, email address, le64.exe path, and (if necessary) the FileMaker Server install path variables to reflect your server’s information and your contact information. Let’s Encrypt will use this contact information to reach out to you if there is a problem with the SSL certificate that they have issued to you.
Test the PowerShell Script
WARNING: Running this PowerShell script will safely restart your FileMaker Server service, abruptly disconnecting any active users. Make sure that nobody is connected to your server before you run this script.
We’re now ready to test the PowerShell script and retrieve a test certificate. Make sure nobody is connected or using your FileMaker server and then run the GetSSL.ps1 PowerShell script by navigating to the directory you have it copied to in your PowerShell window and entering:
.\GetSSL.ps1
A bunch of text will scroll by in the PowerShell window as the script requests, fetches, and installs your SSL certificate. Your FileMaker Server service will then be stopped and started again automatically.
Watch the messages which appear on the screen and look for any errors. If you do see errors the error message may tell you where the problem is with the retrieval of your test certificate. A log file is also written to “SSL-Renewal.log” in the same directory as the PowerShell script.
Assuming things went smoothly, your test SSL certificate should now be installed! Go to your FileMaker Server admin console or try connecting to your FileMaker Server using FileMaker Pro. You may need to close and re-open your browser if you had the page open already. If you’re trying to use FileMaker Pro to test the connection you will need to completely quit and re-open FileMaker Pro to see the new certificate.
The new certificate should show as invalid due to the an invalid certificate authority, but should show your correct domain name. This is good, and means that the test was successful.
Enable Admin Console External Authentication (FMS 17 or later)
FileMaker Server 17 now requires entering a username and password for the process of installing a certificate through the “fmsadmin certificate install” command. This is a new feature of FileMaker 17, and is not a part of earlier versions of FileMaker Server. We need to handle this request for authentication information in our process of installing a certificate. This request can be managed in one of two ways:
A. Use the external authentication for the FMS Admin console to allow the user running the GetSSL script access to the admin console.
B. Include the username and password in the GetSSL script.
Option B would require the admin console username and password to be stored in plain text, and would be insecure. Because of this, we recommend option A and enabling external authentication for the admin console. Configuring this feature will prevent the command from asking for authentication information if the user running the command is allowed access to the admin console.
In step 9 we will need to specify a Windows user with administrator access who will run the GetSSL script to renew and install the certificate. We want to make sure that this user will also have access to the FileMaker Server Admin console using its Windows username and password. We need to configure FMS to allow this user to log in to the admin console by specifying a group that the user is part of.
If you’re using Active Directory you’ll be able to select a group from AD which you want to grant access to the FMS Admin console. If your server is not part of an Active Directory domain you can use a local group on the computer for this access. A good option for this is the “Administrators” group, since our user must be an administrator anyway for other features of the script to work.
In the FileMaker Server Admin console select the Administration menu at the top, then External Authentication from the list on the left side. There are two places we need to adjust.
- External Accounts for Admin Console Sign In – Click the “Change” option and specify the group which should be allowed to access the FMS Admin console. “Administrators” is a good value to use here if you’re not using Active Directory. Click “Save Authentication Settings” to save your entered group name.
- Admin Console Sign In, External Accounts – switch this to “Enabled” to allow the group specified above to log in.
Disable Test Mode and Retrieve The Real Certificate
The PowerShell script comes set to run in test mode by default. If you’ve been able to successfully retrieve the test certificate it means that it is now safe to disable test mode. Change the $testMode variable in GetSSL.ps1 from 1 to 0. Save the file and run the PowerShell script again like you did in the last step. Once it’s finished installing, completely quit FileMaker Pro and your browser and then re-open to test the certificate installation. If you see the green lock icon it means you have successfully retrieved a valid certificate!