Problem

When you run the Synctool or a custom PowerShell script, you see the following error:

The certificate has expired. Please link a new certificate to your app and pass the valid value.

You may also see an error in the Entra ID portal indicating that the certificate attached to the Zivver app registration has expired. Go to portal.azure.com → Entra ID → App registrations → Search for Zivver.

Cause

You are using a self-signed certificate for app-only authentication in Exchange Online. A self-signed certificate has a default expiration period of one year.

Solution

When the self-signed certificate has expired, you must create a new one and upload it to both the Zivver app registration in Entra ID and the Zivver Synctool.

Tip

Temporary ‘Log on locally’ permissions There are multiple ways to install a certificate in the personal certificate store of a service account. This video demonstrates the use of the Security Policy ‘Log on locally’ to temporarily allow the service account to run the certificate snap-in for installing the new self-signed certificate.

Make sure to remove the service account from the Security Policy ‘Log on locally’ afterward, as service accounts should never have permission to log on locally on a Windows Server.

If the video doesn’t load on this page, you can watch it directly on YouTube.

Video timestamps

• Intro
• Part 1 – Update the certificate
• Part 2 – Optional: Update the certificate for custom PowerShell scripts

References

• How to generate a self-signed certificate for app-only authentication
• How to set up app-only authentication