Who Should Read This Article

This article is for customers who use the Web Self Service appliance released with XenServer v6.1 and earlier versions.


This article describes the process of replacing the SSL certificate for the Web Self Service (WSS) appliance. Customers should carry out this procedure as soon as possible. Customers should either replace the default certificate with a new certificate using the procedure below, or generate a per-WSS certificate following the instructions in CTX137717.


WSS maintains its own SSL certificate which expires periodically. The certificate included with the WSS appliance expires on Friday 3rd May 2013 at 11.32 UTC After this point, some web browsers may refuse to connect to WSS, or do so only after issuing warnings which may cause concern about the validity of the connection.

Customers should replace this certificate with a new certificate available from ShareFile (or generate new certificates) unless they have already installed their own certificates (following the instructions in Appendix B of the Web Self Service Installation Guide).


Root access to the WSS appliance.


  1. Open the console of the WSS appliance, and log on as the root user.
  2. Stop the webss service. To do this, enter:

    /etc/init.d/webss stop

  3. Rename and move the old .crt file as ssl.crt.orig. To do this, enter:

    mv /root/sse/conf/ssl.crt /root/sse/conf/ssl.crt.orig

  4. Place the new CTX137714_ssl.crt into the correct location on the WSS appliance. To do this, enter:

    cp CTX137714_ssl.crt /root/sse/conf/

  5. Start the webss service.To do this, enter:

    /etc/init.d/webss start

More information

For information on installing Web Self Service, refer to CTX135097.

If you experience any difficulties, contact Citrix Technical Support.