How to Generate a CSR on FileMaker Server

This tutorial shows you how to generate a CSR on FileMaker Server. FileMaker Server creates the request itself, either from the Admin Console or with the fmsadmin command line tool, and writes two files into its own CStore folder: the certificate signing request you send to your Certificate Authority, and the matching private key that stays on the server.

A note on names, because both are in use: the product is developed by Claris International Inc., an Apple subsidiary, which brands the platform Claris FileMaker while the server component keeps the name FileMaker Server. Version numbers now follow the release year, so the recent line reads FileMaker Server 2023 (version 20), 2024 (version 21), 2025 (version 22) and FileMaker Server 2026 (version 26), the current release. Versions 23 to 25 were skipped to align the number with the year. Claris keeps only the most recent releases in support, so if you are running FileMaker Server 2024 or older, check your support status before you buy a certificate that will outlive it.

Before you start

A few things decide whether this goes smoothly:

• Work on the machine running FileMaker Server. The private key is written into that machine’s CStore folder and has to stay there. The command line tool also requires a local session: you must be signed in to the server directly or through remote desktop software.
• Use elevated privileges. Writing the private key file needs administrator rights. On Windows, open Command Prompt with Run as Administrator. On macOS and Linux, authenticate with sudo. Without them the command fails with a permissions error.
• Decide the exact host name first. Use the fully qualified domain name clients actually type, the same one that appears in your WebDirect and Admin Console URLs and in the fmnet address FileMaker Pro clients open. A certificate issued for a name nobody uses still produces a browser warning.
• Know which version you are on. The Admin Console has had a Create CSR button since FileMaker Server 19. On FileMaker Server 17 and 18 the fmsadmin command line was the only way to create a request.

FileMaker Server ships with a default certificate signed by Claris that does not verify the server name. It is meant for testing only, and Admin Console shows security warnings while it is in use, which is why a custom certificate from a Certificate Authority is required in production.

One more thing to plan for if you run a multiple-machine deployment: each machine needs its own certificate. Create a separate request on the primary machine and on every secondary machine, and import a certificate on each of them.

Generate the CSR on FileMaker Server

If you already generated your CSR somewhere else, skip this section and continue with the FileMaker Server installation steps once your certificate is issued. Otherwise pick one of the two methods below. They produce the same pair of files, so use whichever fits your access to the server.

Method 1: Create the CSR in the Admin Console

This is the shortest route on FileMaker Server 19 and later, including FileMaker Server 2023, 2024, 2025 and 2026.

1. Sign in to the Admin Console and open the Configuration > SSL Certificate tab.
2. Click Create CSR.
3. Fill in the request fields:
   • Domain name: the fully qualified domain name of your server, for example fms.yourcompany.com. For a wildcard certificate, put the wildcard here instead, for example *.yourcompany.com.
   • Organization (Company name): the full legal name of your company, exactly as registered.
   • Organization unit: the department requesting the certificate, such as IT. This one barely matters now: since 1 September 2022 the CA/Browser Forum Baseline Requirements have barred public CAs from putting the Organizational Unit field in issued certificates, so whatever you type here will not end up in the certificate.
   • City: the city where your server is located, spelled out in full.
   • State or Province: the state or province, also spelled out in full (Florida, not FL).
   • Country: the two-letter code for your country, for example US.
4. Enter and confirm an encryption password for the private key file. Write it down. You have to type the same password into the Private Key Password field when you import the signed certificate later, and there is no way to recover it from the key.
5. Click Create. FileMaker Server writes serverRequest.pem and serverKey.pem into the CStore folder.
6. Click Copy to put the request on your clipboard, then paste it into the CSR box on your certificate order form.

Method 2: Create the CSR with the fmsadmin command line

The command line works on every version from FileMaker Server 17 onward, current releases included. The fmsadmin tool lives here:

• Windows: [drive]:\Program Files\FileMaker\FileMaker Server\Database Server\fmsadmin.exe
• macOS: /Library/FileMaker Server/Database Server/bin/fmsadmin
• Linux: /opt/FileMaker/FileMaker Server/Database Server/bin/fmsadmin

The installer adds a symbolic link on macOS (/usr/local/bin/fmsadmin) and on Linux (/usr/bin/fmsadmin), so the command works from any directory there. On Windows, if the command is not recognized, change to the Database Server folder shown above first or call the executable by its full path.

The simplest form takes just the server name:

fmsadmin certificate create fms.yourcompany.com --keyfilepass yourSecretPassphrase

Most Certificate Authorities want more than the host name, so pass a full subject instead. Note the double quotation marks: they are required as soon as any value contains a space.

fmsadmin certificate create "/CN=fms.yourcompany.com/O=Your Company LLC/C=US/ST=Florida/L=Miami" --keyfilepass yourSecretPassphrase

What goes in each attribute:

• CN (Common Name): the fully qualified domain name you want to secure, or a wildcard such as *.yourcompany.com.
• O (Organization): the full legal name of your company.
• C (Country): the two-letter country code, for example US.
• ST (State or Province): the full name of the state or province, not an abbreviation.
• L (Locality): the full name of the city.
• --keyfilepass: the password that encrypts serverKey.pem. FileMaker’s built-in CLI help describes this option as required for the create operation, and every example in Claris’s documentation includes it, so set one and record it. You will need the same password at import time. Because you type it on the command line, it stays visible on screen and is normally written to the shell’s command history, so clear that entry afterwards on any machine other people can sign in to.

The subject follows the same syntax as the -subj argument of OpenSSL’s req command: it is not case sensitive, it is formatted as /type=value pairs, and special characters inside a value have to be escaped with a backslash. To see the exact options your build supports, run:

fmsadmin help certificate

Where FileMaker Server puts the files

Both methods write the same two files into the CStore folder:

• serverRequest.pem: your certificate signing request. This is the file whose contents you send to the CA.
• serverKey.pem: the encrypted private key. It never leaves the server and is never sent to the CA. Anyone holding it can impersonate your FileMaker Server, so if it is exposed, start over with a new request and have the certificate reissued.

The CStore folder is here, depending on the operating system:

• Windows: [drive]:\Program Files\FileMaker\FileMaker Server\CStore\
• macOS: /Library/FileMaker Server/CStore/
• Linux: /opt/FileMaker/FileMaker Server/CStore/

Creating a CSR does not change how the server runs, so no restart is needed at this stage. The restart comes later, after you import the signed certificate. If you need to scrap a request and begin again, remove the existing request and key first:

fmsadmin certificate delete

Be careful with that one on a live server: it removes the certificate request, the private key and any custom certificate already installed, and the change takes effect after a restart. Until a custom certificate is in place again, FileMaker Server falls back to the default Claris certificate.

Submit the CSR to your Certificate Authority

Open serverRequest.pem in a plain text editor such as Notepad or TextEdit. You will see a block like this:

-----BEGIN CERTIFICATE REQUEST-----
MIICvDCCAaQCAQAwdzELMAkGA1UEBhMCVVMxEDAOBgNVBAgMB0Zsb3JpZGEx
... (many lines of base64) ...
-----END CERTIFICATE REQUEST-----

Select the whole block, including the BEGIN CERTIFICATE REQUEST and END CERTIFICATE REQUEST lines (each marker has five hyphens on either side), and paste it into the CSR box on your order form. Do not open the file in a word processor that adds formatting, and do not retype it by hand.

Before you place the order, it is worth reading the request back. Paste it into our CSR Decoder and confirm the Common Name matches the host name clients use and that the organization details are spelled correctly. A typo here means the CA issues a certificate you cannot use, and a reissue costs you another validation round. If you have OpenSSL on a workstation, the same check runs locally:

openssl req -noout -text -verify -in serverRequest.pem

When the certificate arrives, you import it together with the private key and the intermediate (CA bundle) file, then restart the Database Server. Our guide on how to install an SSL certificate on FileMaker Server covers both the Admin Console and the fmsadmin import. One requirement to keep in mind at order time: the certificate has to be delivered in Base64 (PEM) encoding, and file names must not contain unsupported characters such as an asterisk.

Wildcards and multi-domain (SAN) certificates

FileMaker Server can use a single-domain certificate, a wildcard certificate or a multi-domain (SAN) certificate once it is imported. The limitation is only in the request tools: the Admin Console and the fmsadmin command can create a request for a single domain or a wildcard, but not for a SAN certificate. Claris documents this limitation for both routes, and it is unchanged in current releases.

For a wildcard, nothing special is needed: enter the wildcard as the domain name or Common Name, for example *.yourcompany.com. For several distinct host names you have two options.

Option 1, the route Claris documents: create a normal single-domain request as above, send it to your CA, and ask them to extend the issued certificate with the additional names.

Option 2, build the request outside FileMaker Server: generate the CSR and key yourself and supply the key at import time. This is explicitly supported: the Admin Console import screen tells you to select the private key you obtained through whichever method you used, and the command line has a --keyfile option for exactly this case. Our CSR Generator builds a SAN request from a single form, or you can use OpenSSL on any machine:

openssl req -new -newkey rsa:2048 -nodes \
-keyout fms.key \
-out fms.csr \
-subj "/CN=fms.yourcompany.com/O=Your Company LLC/C=US/ST=Florida/L=Miami" \
-addext "subjectAltName=DNS:fms.yourcompany.com,DNS:db.yourcompany.com"

Repeat the Common Name inside the SAN list, as shown, because clients validate host names against the SAN entries and ignore the Common Name. Keep fms.key somewhere you can browse to from the Admin Console; you do not need to copy it into the CStore folder yourself. Because -nodes leaves the key unencrypted, leave the Private Key Password field blank at import time.

When you do not need a CSR at all

FileMaker Server can request a free Let’s Encrypt certificate on its own, with no CSR and no manual import, but only on recent releases. In FileMaker Server 2025 (version 22) and later, the Admin Console does it: open Configuration > SSL Certificate, click Request Let’s Encrypt Certificate, enter your fully qualified domain name, and optionally turn on Automatically Renew Certificate. Test Validation checks whether FileMaker Server is publicly reachable under that name, which tells you whether a request would succeed.

Older releases are not equivalent, so check your version before you go looking for that button. FileMaker Server 2024 (version 21.0.1) was the first release with anything built in, and it is command line only: a pair of request and renew shell scripts in the Tools/Lets_Encrypt folder of the FileMaker Server installation, which also require you to install Certbot yourself. Read the README next to those scripts for the exact file names and prerequisites, since the names differ between 2024 releases. FileMaker Server 19 and FileMaker Server 2023 (version 20) have no built-in Let’s Encrypt support at all, so on those releases the CSR route above is the only route.

Two conditions decide whether this is an option for you at all: the domain must be publicly reachable on port 80 during HTTP validation, and wildcards are not supported. Servers that are not exposed to the internet, and anyone who needs a wildcard, Organization Validation, Extended Validation or a longer term, go through the CSR route described above.

FileMaker Server 15 and 16 (legacy)

These releases are long past end of life and receive no security updates, so treat this as a stopgap and plan an upgrade. On FileMaker Server 15 and 16 the Admin Console creates the request from a different place: open the Database Server > Security tab and click Create Request. Fill in Domain name (a wildcard such as *.yourcompany.com is accepted here too), Company name, Organization, City, State or Province and Country, then enter and confirm an encryption password for the private key and click Create.

The console, not the command line, writes serverRequest.pem and serverKey.pem into the CStore folder, and you copy the contents of serverRequest.pem into your order form exactly as described above. The SAN limitation applies here as well.

Frequently Asked Questions