MyQ Scan Review
MyQ Scan Review
Breadcrumbs

Server Certificate Requirements

Before you can enable HTTPS, make sure the certificate meets the following requirements:

  • The certificate is installed in the Local Computer certificate store.

  • The certificate includes a private key that is accessible to the LOCAL SYSTEM account, which is used to run the MyQ Scan Review service.

  • The certificate's Subject Alternative Name (SAN) matches the hostname entered for Scan Review. Certificates whose SAN does not match the entered hostname are not displayed in the certificate dropdown.

  • The certificate's Key Usage (KU) is either not specified (None) or set to digitalSignature.

  • The certificate's Extended Key Usage (EKU) is either not specified (None), or set to one of the following:

    • 2.5.29.37.0 — Any Purpose.

    • 1.3.6.1.5.5.7.3.36 — IETF Document Signing.

    • 1.3.6.1.4.1.311.10.3.12 — Microsoft Document Signing.

Certificates with a different, non-empty KU or EKU are filtered out and are not displayed in the certificate dropdown.

Verify that the Certificate has a Private Key

  1. Open certlm.msc.

  2. Go to Personal > Certificates.

  3. Open the certificate you want to use.

  4. On the General tab, verify that the following message is displayed: "You have a private key that corresponds to this certificate."

Restart

Only changes to the HTTPS port require a restart of the MyQ Scan Review Windows service.

Changes to the hostname or certificate take effect without restarting the service.