---
title: "Replace the Digital Certificate Used by Lasernet Config Server"
slug: "replace-the-digital-certificate-used-by-lasernet-config-server"
description: "Describes how to use a script to replace the digital certificate used by Lasernet Config."
tags: ["Certificates", "Lasernet Core"]
updated: 2026-07-31T06:28:14Z
published: 2026-07-31T06:28:14Z
canonical: "kb.lasernetgroup.com/replace-the-digital-certificate-used-by-lasernet-config-server"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://kb.lasernetgroup.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Replace the Digital Certificate Used by Lasernet Config Server

**Applies to:** Lasernet 9, Lasernet Core 10

To prevent temporary service interruptions caused by certificate expiry, it is crucial to replace the digital certificate used by Lasernet Config before its expiry date. We also recommend replacing the default certificate generated during installation with your own.

To import a new certificate issued by a certificate authority, you must acquire the certificate in PFX format. Else, a new self-signed certificate can be generated. However, we recommend that self-signed certificates are used only for test environments.

You can use a script to generate a new self-signed certificate (if necessary), import the new self-signed or certificate-authority-issued certificate into the Windows keystore, and bind the certificate to Lasernet Config.

This script:

- Generates a new self-signed certificate or imports an existing certificate.
- Exports the certificate to your `Documents` directory.
- Updates the Config Server bindings to use the new certificate for the specified host name and for localhost (when generating a self-signed certificate).
- Imports the certificate to the trusted root store (if using the `ImportAsTrustedRoot` switch).
- Clears down existing port/IP bindings to ensure the new certificate binds correctly.

## Steps

To use the script, follow these steps:

1. Download and unzip the following ZIP file: [https://lngsupportdownloads.blob.core.windows.net/lasernet/Tools/New-LNConfigServerCert_v1.2.zip](https://lngsupportdownloads.blob.core.windows.net/lasernet/Tools/New-LNConfigServerCert_v1.2.zip). This file contains a `.ps1` PowerShell script.
2. **If Lasernet Config uses a certificate-authority-issued certificate:** Acquire a new certificate in PFX format.
3. Remove the current certificate from the Windows keystore.
4. Start PowerShell and then run the `New-LnConfigServerCert.ps1` script with appropriate parameters. Change the `-LnVersion` parameter value to match the Lasernet version. The following commands are examples of typical use:
  - Generate and use a self-signed certificate. The script assumes that the Config Server host name is the computer name.

`PS> .\New-LnConfigServerCert.ps1 -LnVersion 10`
  - Generate and use a self-signed certificate that is valid for eight months and is for a specified host name.

`PS> .\New-LnConfigServerCert.ps1 -LnVersion 10 -CertHostName my.test.lasernetgroup.com -ValidMonths 8 -ImportAsTrustedRoot`
  - Import an existing certificate from a keystore.

`PS> .\New-LnConfigServerCert.ps1 -LnVersion 10 -KeystorePath path\to\keystore.pfx -ImportAsTrustedRoot`